You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardexpand all lines: content/apply-for-inclusion.md
+5-5
Original file line number
Diff line number
Diff line change
@@ -12,13 +12,13 @@ title: Apply for Inclusion
12
12
13
13
## Last updated: 2025-02-15
14
14
15
-
The Chrome Root Program Policy defines the [minimum requirements](policy.md) that must be met by Certification Authority (CA) Owners for both initial and continued inclusion in the Chrome Root Store.
15
+
The Chrome Root Program Policy defines the [minimum requirements](policy) that must be met by Certification Authority (CA) Owners for both initial and continued inclusion in the Chrome Root Store.
16
16
17
17
Google includes or removes self-signed root CA certificates in the Chrome Root Store as it deems appropriate at its sole discretion. The selection and ongoing inclusion of CA certificates is done to enhance the security of Chrome and promote interoperability. CA certificates that do not provide a broad service to all browser users will not be added to, or may be removed from the Chrome Root Store. CA certificates included in the Chrome Root Store must provide value to Chrome end users that exceeds the risk of their continued inclusion.
18
18
19
19
### Inclusion Processing
20
20
21
-
The Chrome Root Program and corresponding Root Store processes inclusion requests and requests for changes through the Common CA Database (CCADB). CA Owners who satisfy all of the requirements in the Chrome Root Program [Policy](policy.md) may apply.
21
+
The Chrome Root Program and corresponding Root Store processes inclusion requests and requests for changes through the Common CA Database (CCADB). CA Owners who satisfy all of the requirements in the Chrome Root Program [Policy](policy) may apply.
22
22
23
23
The application process includes:
24
24
@@ -46,7 +46,7 @@ Illustrative behaviors demonstrating value include:
46
46
* supporting customers in multiple geographic markets and in multiple native languages.
47
47
* freely-available guidance, help articles, or FAQ to support the user community in requesting/renewing certificates or configuring TLS.
48
48
* not relying on “cached" domain validation information during certificate issuance.
49
-
* leveraging operational practices consistent with those described in [Moving Forward, Together](moving-forward-together.md) at the time of application submission. For example, reliably issuing TLS server authentication certificates that are valid for a much shorter period of time than the maximum validity allowed by the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates.
49
+
* leveraging operational practices consistent with those described in [Moving Forward, Together](moving-forward-together) at the time of application submission. For example, reliably issuing TLS server authentication certificates that are valid for a much shorter period of time than the maximum validity allowed by the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates.
50
50
* supporting the Automatic Certificate Management Environment (ACME) protocol and the ACME Renewal Information (ARI) extension, complemented by technical controls that encourage cryptographic agility.
51
51
* responsibly operating [Certificate Transparency](https://googlechrome.github.io/CertificateTransparency/) log(s) qualified in Chrome.
52
52
@@ -58,7 +58,7 @@ CA Owners should not anticipate receiving application coaching beyond what is sp
58
58
59
59
### Inclusion Rejection
60
60
61
-
The Chrome Root Program will reject inclusion requests where an applicant does not meet the minimum requirements defined by the Chrome Root Program [Policy](policy.md) or the application is deemed incomplete or inaccurate.
61
+
The Chrome Root Program will reject inclusion requests where an applicant does not meet the minimum requirements defined by the Chrome Root Program [Policy](index) or the application is deemed incomplete or inaccurate.
62
62
63
63
The Chrome Root Program may reject requests for inclusion into the Chrome Root Store as deemed appropriate, and is not obligated to justify any inclusion decision.
64
64
@@ -70,7 +70,7 @@ Illustrative factors for application rejection may include:
70
70
* where the corresponding CA Owner has ever been:
71
71
* determined to have acted in an untrustworthy manner or created unnecessary ecosystem risk, or
72
72
* associated with a certificate that was previously distrusted by Chrome or any other public root program.
73
-
* has an incident history that does not convey the [factors](policy.md#51-incident-reports) significant to Chrome.
73
+
* has an incident history that does not convey the [factors](index#51-incident-reports) significant to Chrome.
74
74
* completion of a CCADB root inclusion public discussion that casts doubt over the CA Owners security, honesty or reliability.
75
75
* discovery of false or misleading information provided by the CA Owner.
76
76
* significant delays in response from the CA Owner when seeking additional or clarifying information.
Copy file name to clipboardexpand all lines: content/index.md
+2-2
Original file line number
Diff line number
Diff line change
@@ -61,7 +61,7 @@ The Chrome Root Program Policy below establishes the minimum requirements for CA
61
61
62
62
### Apply for Inclusion
63
63
64
-
CA Owners that satisfy the requirements defined in the policy below may apply for self-signed root CA certificate inclusion in the Chrome Root Store using [these](apply-for-inclusion.md) instructions.
64
+
CA Owners that satisfy the requirements defined in the policy below may apply for self-signed root CA certificate inclusion in the Chrome Root Store using [these](apply-for-inclusion) instructions.
65
65
66
66
### Chrome's Ongoing Commitment to Transport Security
67
67
@@ -78,7 +78,7 @@ Chrome maintains a variety of mechanisms to protect its users from certificates
78
78
79
79
The "Moving Forward, Together" initiative envisions a future Web PKI that includes modern, reliable, highly agile, purpose-driven PKIs with an emphasis on automation, simplicity, and security.
80
80
81
-
Learn more about priorities and initiatives that may influence future versions of this policy [here](moving-forward-together.md). Please note "Moving Forward, Together" is future looking and does not describe normative requirements.
81
+
Learn more about priorities and initiatives that may influence future versions of this policy [here](moving-forward-together). Please note "Moving Forward, Together" is future looking and does not describe normative requirements.
The initiatives described on this page are distinct from the requirements detailed in the [Chrome Root Program Policy](policy.md). These initiatives are proposals for exploration. They are not requirements.
28
+
The initiatives described on this page are distinct from the requirements detailed in the [Chrome Root Program Policy](index). These initiatives are proposals for exploration. They are not requirements.
29
29
30
30
Some proposals may change during our review process, after considering community feedback, or studying the ecosystem impacts and tradeoffs of adoption. Others may not be adopted at all.
31
31
@@ -65,7 +65,7 @@ This helps ensure our decisions are informed by real-world data, observed Chrome
65
65
66
66
Certificates issued by publicly-trusted CA Owners (i.e., those included in various product and operating system trust stores) serve a variety of use cases including TLS server authentication, TLS client authentication, secure email (e.g., signed and encrypted email), document signing, code signing, and others. Up until about five years ago, it was common to see some or all of these use cases served from a single PKI hierarchy. While this approach offered flexibility to some stakeholders, there is inherent complexity of balancing multiple, sometimes competing use cases and requirements, especially as the CA/Browser Forum created additional sets of standards focused on use cases beyond TLS.
67
67
68
-
Beginning in September 2022, the Chrome Root Program [codified](policy-archive/policy-version-1-1.md#4-dedicated-tls-pki-hierarchies) its commitment to simplicity by requiring applicant PKI hierarchies to the Chrome Root Store focus only on serving TLS use cases. However, while this approach promotes future simplicity, not all CA certificates included in the Chrome Root Store are aligned on this principle. To do so, and to completely realize the benefits of the transition to TLS-dedicated hierarchies, we intend to remove "multi-purpose" root CA certificates, or those CA certificates not dedicated to TLS server authentication use cases, from the Chrome Root Store.
68
+
Beginning in September 2022, the Chrome Root Program [codified](policy-archive/policy-version-1-1#4-dedicated-tls-pki-hierarchies) its commitment to simplicity by requiring applicant PKI hierarchies to the Chrome Root Store focus only on serving TLS use cases. However, while this approach promotes future simplicity, not all CA certificates included in the Chrome Root Store are aligned on this principle. To do so, and to completely realize the benefits of the transition to TLS-dedicated hierarchies, we intend to remove "multi-purpose" root CA certificates, or those CA certificates not dedicated to TLS server authentication use cases, from the Chrome Root Store.
69
69
70
70
**Why it matters:**
71
71
@@ -163,7 +163,7 @@ The Chrome Root Program participated in drafting CA/Browser Forum [Ballot SC-075
163
163
164
164
**Theme:** "Encouraging modern infrastructures and agility"
165
165
166
-
In Chrome Root Program Policy 1.5, we [landed](policy-archive/policy-version-1-5.md#root-ca-term-limit) changes that set a maximum "term-limit" (i.e., period of inclusion) for root CA certificates included in the Chrome Root Store to 15 years.
166
+
In Chrome Root Program Policy 1.5, we [landed](policy-archive/policy-version-1-5#root-ca-term-limit) changes that set a maximum "term-limit" (i.e., period of inclusion) for root CA certificates included in the Chrome Root Store to 15 years.
167
167
168
168
While we still prefer a more agile approach, and may again explore this in the future, we encourage CA Owners to explore how they can adopt more frequent root rotation.
0 commit comments