CA Operations & Compliance

Running a publicly-trusted CA requires:

Certificate Practice Statement (CPS):

• Public document describing CA policies, validation procedures, security controls.
• Published; must match actual operations.

Audits:

• WebTrust for CAs: annual external audit covering policy + operations.
• Browser root program criteria (Mozilla, Google, Microsoft, Apple): each has its own.
• Failed audit → potential distrust.

Validation procedures:

• DV: ACME / DNS / HTTP / TLS-ALPN. Domain ownership only.
• OV: validate organization legal identity (D&B records, manual review).
• EV: extended validation. Now de-emphasized in browsers (no more green address bar).

Incident response:

• Mis-issuance: revoke + post-mortem within 24 hours.
• Public disclosure (CCADB) of all incidents.
• Repeated incidents → distrust.

Logging:

• Everything: CSR receipts, validation results, issuance events, revocation events.
• Tamper-evident logs (Merkle-chained, multiple sites).

Distrust events:

• Symantec (2018): repeated mis-issuance + audit failures → Chrome/Mozilla distrust by 2019.
• WoSign / StartCom (2017): backdating certs to bypass deprecation deadlines → distrust.
• DigiNotar (2011): breached, fake certs issued → bankruptcy + distrust.
• Each took ~1 year to fully unwind in the ecosystem.

Compliance frameworks:

• WebTrust for CAs (gold standard).
• ETSI EN 319 411 (Europe).
• FIPS 140-2 (HSMs).
• SOC 2 Type II (operational controls).
• PCI DSS (if processing payment-related certs).

Internal CAs (corporate, IoT, government) skip most of this — they're not in browser root stores. But still need basic hygiene: HSM keys, audit logs, controlled issuance.

Building a public CA is a multi-year, multi-million-dollar effort. Operating one safely is an ongoing security discipline.