Package de.mtg.jzlint.lints.mozilla
package de.mtg.jzlint.lints.mozilla
-
ClassesClassDescriptionSection 5.3 - Intermediate Certificates Intermediate certificates created after January 1, 2019, with the exception of cross-certificates that share a private key with a corresponding root certificate: MUST contain an EKU extension; and, MUST NOT include the anyExtendedKeyUsage KeyPurposeId; and, * MUST NOT include both the id-kp-serverAuth and id-kp-emailProtection KeyPurposeIds in the same certificate.Section 5.2 - Forbidden and Required Practices CAs MUST NOT issue certificates that have: - incorrect extensions (e.g., SSL certificates that exclude SSL usage, or authority key IDs that include both the key ID and the issuer’s issuer name and serial number);https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ When ECDSA keys are encoded in a SubjectPublicKeyInfo structure, the algorithm field MUST be one of the following, as specified by RFC 5480, Section 2.1.1: The encoded AlgorithmIdentifier for a P-256 key MUST match the following hex-encoded bytes: > 301306072a8648ce3d020106082a8648ce3d030107.https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ When a root or intermediate certificate's ECDSA key is used to produce a signature, only the following algorithms may be used, and with the following encoding requirements: If the signing key is P-256, the signature MUST use ECDSA with SHA-256.Section 5.2 - Forbidden and Required Practices CAs MUST NOT issue certificates that have: - invalid public keys (e.g., RSA certificates with public exponent equal to 1);Section 5.1 - Algorithms RSA keys whose modulus size in bits is divisible by 8, and is at least 2048.Section 5.1 - Algorithms RSA keys whose modulus size in bits is divisible by 8, and is at least 2048.https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ Section 5.1.1 RSA CAs MUST NOT use the id-RSASSA-PSS OID (1.2.840.113549.1.1.10) within a SubjectPublicKeyInfo to represent a RSA key.https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ Subsection 5.1 Algorithms Root certificates in our root program, and any certificate which chains up to them, MUST use only algorithms and key sizes from the following set: - RSA keys whose modulus size in bits is divisible by 8, and is at least 2048https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ Section 5.1.1 RSA RSASSA-PSS with SHA-256, MGF-1 with SHA-256, and a salt length of 32 bytes.