Skip to content

Commit fe05685

Browse files
konklonekonklone
committed
add language about cross-certification
1 parent 6cc8acd commit fe05685

2 files changed

Lines changed: 5 additions & 1 deletion

File tree

‎_config.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ navigation:
4444
url: /faq/
4545
- text: Certificates
4646
url: /certificates/
47-
- text: Strict Transport Security
47+
- text: HTTP Strict Transport Security
4848
url: /hsts/
4949
- text: Server Name Indication
5050
url: /sni/

‎pages/certificates.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,10 @@ The [Federal PKI](http://www.idmanagement.gov/federal-public-key-infrastructure)
7070

7171
The Federal PKI has an [open application](https://bugzilla.mozilla.org/show_bug.cgi?id=478418) to the Mozilla Trusted Root Program. However, even if the Federal PKI's application is accepted, it will take a significant amount of time for the Federal PKI's root certificate to actually be shipped onto devices and propagate widely around the world.
7272

73+
The Federal PKI has ["cross-certified" other agencies and commercial CAs](http://www.idmanagement.gov/entities-cross-certified-federal-bridge), which means their roots will be trusted by clients that trust the Federal PKI. However, none of these roots are _publicly trusted_. Even when a publicly trusted commercial CA is cross-certified with the Federal PKI, they maintain complete separation between their publicly trusted roots and their Federal PKI cross-certified roots.
74+
75+
As a result, there is not currently a viable way to obtain an individual certificate that is issued or trusted by the Federal PKI, and also trusted by the general public.
76+
7377
## Are there federal restrictions on acceptable certificate authorities to use?
7478

7579
There are no government-wide rules limiting what CAs federal domains can use.

0 commit comments

Comments
 (0)