Comprehensive Overview of CA/Browser Forum TLS Baseline Requirements

1. Certificate Validity Period

The CA/Browser Forum has established strict guidelines regarding the validity periods of TLS certificates to enhance security and reduce risk. As of September 1, 2020, the maximum validity period for publicly trusted TLS/SSL certificates is limited to 397 days, which is approximately 13 months. This policy encourages more frequent renewal of certificates, ensuring that cryptographic standards remain up-to-date and reducing the window of opportunity for potential certificate misuse or compromise.

2. TLS Version Support

a. Supported TLS Versions

To maintain robust security standards, the CA/Browser Forum mandates the use of modern TLS protocols:

• Government Sites: Must use TLS 1.2 and are strongly encouraged to support TLS 1.3 by January 1, 2024. The use of outdated protocols such as TLS 1.1 and TLS 1.0 is generally discouraged, while SSL 2.0 and SSL 3.0 are explicitly prohibited.
• Citizen or Business-Facing Applications: Should negotiate TLS 1.2 and aim to support TLS 1.3 by the same deadline. Although TLS 1.1 and TLS 1.0 are discouraged, they may be configured for compatibility with certain third-party services.

b. Cipher Suites and Cryptography

The selection of cipher suites is critical for establishing secure TLS connections. The CA/Browser Forum requires the use of strong cryptographic algorithms and enforces minimum key sizes to protect against potential attacks. Specifically:

• RSA keys must be at least 2048 bits.
• Elliptic Curve Cryptography (ECC) keys must be at least 256 bits.
• Secure hash functions like SHA-256 or stronger must be utilized.

These requirements ensure that only robust and current cryptographic practices are employed, mitigating vulnerabilities associated with weaker or deprecated algorithms.

3. Certificate Transparency (CT)

Certificate Transparency is a framework designed to enhance the security and trustworthiness of the SSL/TLS ecosystem. Under the Baseline Requirements:

• All issued certificates must be logged in publicly accessible CT logs prior to issuance. This transparency allows domain owners and other stakeholders to monitor and verify certificate issuance.
• The required number of Signed Certificate Timestamp (SCT) entries depends on the certificate's lifetime. For certificates valid for less than 15 months, at least two SCT entries are mandatory.

This requirement helps detect and prevent unauthorized or malicious certificate issuance, thereby protecting domain owners and users from potential man-in-the-middle attacks.

4. Certificate Lifecycle Management

a. Issuance and Renewal

Proper management of the certificate lifecycle is essential for maintaining security. The Baseline Requirements stipulate:

• Certificates must be issued only after thorough validation of the applicant's identity and control over the domain.
• Renewal processes must adhere to the same stringent validation criteria as initial issuance to ensure continuous trust.

b. Revocation Processes

In cases where certificates are compromised or no longer valid, timely revocation is crucial. The Baseline Requirements mandate:

• Maintenance of up-to-date Certificate Revocation Lists (CRLs).
• Support for the Online Certificate Status Protocol (OCSP) to provide real-time revocation statuses.

These measures ensure that revoked certificates are promptly recognized and invalidated, preventing their misuse.

5. Domain Validation and Identity Verification

a. Domain Validation

Before issuing a certificate, Certificate Authorities (CAs) must verify that the applicant has legitimate control over the domain in question. This involves:

• Ensuring the domain ownership through methods such as email verification, DNS record checks, or other accepted validation techniques.

This process guarantees that only authorized entities can obtain certificates for their respective domains, preventing impersonation and other malicious activities.

b. Extended Validation (EV) Requirements

For EV certificates, which provide a higher level of assurance and display a prominent visual indicator in browsers, the Baseline Requirements enforce stricter validation procedures:

• Comprehensive verification of the legal, physical, and operational existence of the entity requesting the certificate.
• Validation of the entity's exclusive right to use the domain.
• Rigorous checks to confirm that the applicant has authorized the issuance of the certificate.

These enhanced verification measures ensure that EV certificates are only granted to legitimate and verified entities, thereby increasing user trust.

6. Strong Cryptography

The Baseline Requirements emphasize the necessity of utilizing strong cryptographic algorithms to protect data integrity and confidentiality:

• Minimum key sizes: RSA 2048 bits, ECC 256 bits.
• Usage of secure algorithms and hash functions such as SHA-256 or higher.
• Deprecation of weaker protocols and algorithms, ensuring that only robust cryptographic standards are in use.

By enforcing these standards, the requirements mitigate the risk of cryptographic attacks and ensure secure communications across the internet.

7. Auditing and Compliance

To maintain high security and trust standards, CAs must undergo regular audits to verify compliance with the Baseline Requirements:

• Annual audits conducted by independent third parties to assess adherence to policies and procedures.
• Continuous monitoring and updating of practices to align with the latest security standards and threat landscapes.

These compliance measures ensure that CAs consistently uphold the established guidelines, fostering a secure and trustworthy certificate ecosystem.

8. Policy and Practice Statements

CAs are required to maintain and publish comprehensive Certificate Policy (CP) and Certification Practice Statement (CPS) documents:

• Certificate Policy (CP): Outlines the rules and guidelines under which certificates are issued, managed, and revoked.
• Certification Practice Statement (CPS): Details the specific practices and procedures a CA follows to implement the CP.

These documents provide transparency and accountability, allowing stakeholders to understand the operational standards and security measures employed by CAs.

9. Enforcement and Sanctions

Compliance with the Baseline Requirements is mandatory for CAs to be recognized as trusted entities by major browsers and operating systems. Non-compliance can result in severe sanctions, including:

• Revocation of trust status, rendering the CA unable to issue certificates recognized by browsers.
• Financial penalties or other regulatory actions as deemed necessary by oversight bodies.

These enforcement measures ensure that CAs consistently adhere to the highest security and operational standards, maintaining the integrity of the certificate ecosystem.

10. Evolution and Updates of Requirements

The Baseline Requirements are not static; they are periodically reviewed and updated by the CA/Browser Forum to address emerging security threats and evolving technological standards:

• Incorporation of new cryptographic standards and deprecation of outdated ones.
• Enhancements to validation processes to counter sophisticated fraud attempts.
• Adaptation to changes in regulatory and industry landscapes to ensure ongoing relevance and effectiveness.

This proactive approach ensures that the requirements remain robust against current and future security challenges, safeguarding online communications.

11. Subscriber Agreements

CAs must establish formal agreements with certificate subscribers that outline the rights, responsibilities, and obligations of both parties:

• Responsibilities related to the proper use and protection of issued certificates.
• Conditions under which certificates can be revoked or require renewal.
• Legal obligations pertaining to the accuracy of information provided during the certificate issuance process.

These agreements ensure that subscribers are aware of their duties in maintaining certificate security and compliance with established policies.

12. Transparency Reporting

CAs are encouraged to provide transparency reports that detail their operational practices and security measures:

• Statistics on certificate issuance, renewal, and revocation.
• Information on compliance with the Baseline Requirements and any deviations or incidents.
• Details about audits, security incidents, and measures taken to address vulnerabilities.

These reports enhance accountability and allow stakeholders to assess the reliability and security posture of CAs.

Conclusion

The CA/Browser Forum's TLS Baseline Requirements establish a comprehensive framework designed to secure the digital certificate ecosystem. By enforcing strict standards on certificate validity, cryptographic strength, validation processes, transparency, and compliance, these requirements ensure that TLS certificates remain a reliable mechanism for securing internet communications. Regular updates and stringent enforcement mechanisms further reinforce the resilience and trustworthiness of online security infrastructures, benefiting users, organizations, and the broader digital landscape.