PSM:EV Testing Easy Version: Difference between revisions
Jump to navigation
Jump to search
m (added note that the tool can be run locally for debugging) |
|||
| (37 intermediate revisions by 4 users not shown) | |||
| Line 1: | Line 1: | ||
This page is for [[CA:FAQ#What_are_CAs.3F | Certificate Authorities (CAs)]] who request to have a root certificate enabled for [https:// | This page is for [[CA:FAQ#What_are_CAs.3F | Certificate Authorities (CAs)]] who request to have a root certificate enabled for [https://cabforum.org/extended-validation Extended Validation (EV) treatment], and need to test that their CA hierarchy is ready for EV treatment. | ||
To request that your root certificate be included in [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS NSS] and | Before requesting EV treatment, CAs should understand how [[CA/EV_Processing_for_CAs | Firefox processes EV certificates]] and ensure that they are using the CA/Browser Forum EV OID (2.23.140.1.1), which Mozilla requires. | ||
To request that your root certificate be included in [https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS NSS] and [https://hg.mozilla.org/mozilla-central/file/tip/security/certverifier/ExtendedValidation.cpp enabled for EV treatment], see [[CA/Application_Process|Mozilla's application process]]. | |||
This page explains how you can test that your certificates and OCSP infrastructure are working correctly according to the expectations of Mozilla, Firefox, and the NSS library; and conforms to the SSL protocol specifications (as interpreted by Mozilla/NSS software.) | This page explains how you can test that your certificates and OCSP infrastructure are working correctly according to the expectations of Mozilla, Firefox, and the NSS library; and conforms to the SSL protocol specifications (as interpreted by Mozilla/NSS software.) | ||
| Line 7: | Line 9: | ||
= EV-Readiness Check = | = EV-Readiness Check = | ||
To test your CA hierarchy to see if it is ready to request EV treatment: | To test your CA hierarchy to see if it is ready to request EV treatment: | ||
# Browse to | # Browse to | ||
#* [https://github.com/mozilla/CCADB-Tools/tree/master/evReadiness NEW]: https://evready-dot-ccadb-231121.appspot.com/evready | |||
#* [https://github.com/mozilla/tls-observatory OLD]: https://tls-observatory.services.mozilla.com/static/ev-checker.html | |||
# Enter the URL to the test website for the EV certificate | # Enter the URL to the test website for the EV certificate | ||
# | #* Example: https://observatory.mozilla.org | ||
# Enter the EV Policy OID | # Enter the EV Policy OID | ||
# Enter | #* Example: 2.23.140.1.1 | ||
# Click on " | # Enter the PEM data for the root certificate, or use the "Browse..." button to select the PEM file for the root certificate (ending of file may be .pem or .cert) | ||
#* Begin with: -----BEGIN CERTIFICATE----- | |||
#* End with: -----END CERTIFICATE----- | |||
#* [https://crt.sh/?d=853428 Example PEM Data] - open with a plain text editor like TextEdit | |||
#* [http://ccadb.org/cas/fields#pem-data Help with getting PEM] | |||
# Click on "Submit" | |||
== Success == | |||
A successful result says: "Status: Success!" | |||
Any other text indicates a failure. | |||
== Test Failure? == | == Test Failure? == | ||
The purpose of this test is to make sure you have set up EV according to the [https://www.cabforum.org/documents.html EV Guidelines], so make sure you have not taken short-cuts like issuing the test cert directly from the root. | The purpose of this test is to make sure you have set up EV according to the [https://www.cabforum.org/documents.html EV Guidelines], so make sure you have not taken short-cuts like issuing the test cert directly from the root. | ||
* OCSP must work without error for the intermediate certificates. | * If you get ''Error: Could not initiate scan'', then wait for 3 minutes before trying again. | ||
* The EV Policy OID in the end-entity and intermediate certificates must match the EV Policy OID that | * If you get ''SEC_ERROR_BAD_DATA'', then the program does not like the format of the data you entered. For instance, if you have extra spaces or characters before or after the TLS Server URL, EV Policy OID, or in the Root Certificate PEM. | ||
* If the test website cannot be reached by the server hosting the tool, check to see if you have a firewall preventing access | * The EV test only uses the root certificate it is given. So, if you are using an intermediate certificate that has been cross-signed with another root certificate, you may see different results when browsing to the site in Firefox, as opposed to the results provided by the EV Test. | ||
* OCSP must work without error for the intermediate certificates. | |||
* The EV Policy OID in the end-entity and intermediate certificates must match the EV Policy OID. | |||
** SEC_ERROR_POLICY_VALIDATION_FAILED error may mean that the intermediate certificate being sent by the server doesn't have a certificate policies extension | |||
** SEC_ERROR_EXTENSION_NOT_FOUND may mean that the certificate being sent by the server doesn't contain the specified policy OID. | |||
* If the test website cannot be reached by the server hosting the tool, check to see if you have a firewall preventing access. | |||
* Still failing? Try testing with https://certificate.revocationcheck.com/ because frequently resolving the errors listed on that page will resolve problems with EV testing. | |||
== About the Testing Tool == | == About the Testing Tool == | ||
The code for the Testing Tool is here: https://github.com/ | The code for the Testing Tool is here: https://github.com/mozilla/CCADB-Tools/tree/master/evReady | ||
The Testing Tool... | The Testing Tool... | ||
* Can be run on your local computer for debugging, see https://github.com/mozilla/CCADB-Tools/blob/master/evReady/README.md | |||
* Runs a program on a remote computer rather than the user's browser, so it should work with any browser/version. | * Runs a program on a remote computer rather than the user's browser, so it should work with any browser/version. | ||
* Does not interact with the user's profile, so the user does not need to import the root certificate in order to run the tool. The web server must serve up the intermediate cert(s) along with the end-entity cert. | * Does not interact with the user's profile, so the user does not need to import the root certificate in order to run the tool. The web server must serve up the intermediate cert(s) along with the end-entity cert. | ||
Latest revision as of 16:53, 9 November 2023
This page is for Certificate Authorities (CAs) who request to have a root certificate enabled for Extended Validation (EV) treatment, and need to test that their CA hierarchy is ready for EV treatment.
Before requesting EV treatment, CAs should understand how Firefox processes EV certificates and ensure that they are using the CA/Browser Forum EV OID (2.23.140.1.1), which Mozilla requires.
To request that your root certificate be included in NSS and enabled for EV treatment, see Mozilla's application process.
This page explains how you can test that your certificates and OCSP infrastructure are working correctly according to the expectations of Mozilla, Firefox, and the NSS library; and conforms to the SSL protocol specifications (as interpreted by Mozilla/NSS software.)
EV-Readiness Check
To test your CA hierarchy to see if it is ready to request EV treatment:
- Browse to
- Enter the URL to the test website for the EV certificate
- Example: https://observatory.mozilla.org
- Enter the EV Policy OID
- Example: 2.23.140.1.1
- Enter the PEM data for the root certificate, or use the "Browse..." button to select the PEM file for the root certificate (ending of file may be .pem or .cert)
- Begin with: -----BEGIN CERTIFICATE-----
- End with: -----END CERTIFICATE-----
- Example PEM Data - open with a plain text editor like TextEdit
- Help with getting PEM
- Click on "Submit"
Success
A successful result says: "Status: Success!" Any other text indicates a failure.
Test Failure?
The purpose of this test is to make sure you have set up EV according to the EV Guidelines, so make sure you have not taken short-cuts like issuing the test cert directly from the root.
- If you get Error: Could not initiate scan, then wait for 3 minutes before trying again.
- If you get SEC_ERROR_BAD_DATA, then the program does not like the format of the data you entered. For instance, if you have extra spaces or characters before or after the TLS Server URL, EV Policy OID, or in the Root Certificate PEM.
- The EV test only uses the root certificate it is given. So, if you are using an intermediate certificate that has been cross-signed with another root certificate, you may see different results when browsing to the site in Firefox, as opposed to the results provided by the EV Test.
- OCSP must work without error for the intermediate certificates.
- The EV Policy OID in the end-entity and intermediate certificates must match the EV Policy OID.
- SEC_ERROR_POLICY_VALIDATION_FAILED error may mean that the intermediate certificate being sent by the server doesn't have a certificate policies extension
- SEC_ERROR_EXTENSION_NOT_FOUND may mean that the certificate being sent by the server doesn't contain the specified policy OID.
- If the test website cannot be reached by the server hosting the tool, check to see if you have a firewall preventing access.
- Still failing? Try testing with https://certificate.revocationcheck.com/ because frequently resolving the errors listed on that page will resolve problems with EV testing.
About the Testing Tool
The code for the Testing Tool is here: https://github.com/mozilla/CCADB-Tools/tree/master/evReady
The Testing Tool...
- Can be run on your local computer for debugging, see https://github.com/mozilla/CCADB-Tools/blob/master/evReady/README.md
- Runs a program on a remote computer rather than the user's browser, so it should work with any browser/version.
- Does not interact with the user's profile, so the user does not need to import the root certificate in order to run the tool. The web server must serve up the intermediate cert(s) along with the end-entity cert.