CA Industry Group Creates New Standard for Issuance of SSL/TLS Certificates

SSL certificates are supposed to be a mechanism for authenticating the ownership of Websites.

However, numerous incidents this year have undermined the faith the IT industry has in Certificate Authorities (CAs) and their wares.

In light of this, the CA/Browser Forum, an organization of leading CAs and other software vendors, has released the "Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates,” an industry-wide baseline standard for the operation of CAs issuing SSL/TLS digital certificates natively trusted by the browser.

SSL/TLS Certificate Standards"SSL/TLS certificates are a critical part of the Internet's security infrastructure, combining proven technical standards with the capability to scale to handle millions of websites and the wide array of user software," said Tim Moses, chairman of the CA/Browser Forum, in a statement. "The new Baseline Requirements will improve the reliability and accountability of SSL/TLS issuance for relying parties by establishing baseline standards for all types of SSL/TLS certificates from all publicly-trusted CAs."

The CA/Browser Forum is requesting Web browser and operating systems vendors adopt the requirements as part of their conditions to distribute CA root certificates in their software. According to the forum, the Baseline Requirements are based on best practices from across the SSL/TLS sector and touch on a number of subjects, such as the verification of identity, certificate content and profiles, CA security and revocation mechanisms. The requirements become effective July 1, 2012, and will continue to evolve to address new risks and threats.

Read more: SecurityWeek
QR:

Posted via email from Jasper-net