GC HTTPS Certificate Guidance - Revision history

Michael.brownlie at 22:13, 5 October 2022

2022-10-05T22:13:52Z

Michael.brownlie at 22:13, 5 October 2022

2022-10-05T22:13:11Z

Michael.brownlie at 22:12, 5 October 2022

2022-10-05T22:12:38Z

Michael.brownlie at 22:11, 5 October 2022

2022-10-05T22:11:07Z

Michael.brownlie: /* Wildcard Certificates */

2022-10-05T22:08:10Z

Wildcard Certificates

Michael.brownlie: /* Wildcard Certificates */

2022-10-05T22:07:53Z

Wildcard Certificates

Michael.brownlie: /* HTTP Public Key Pinning (HPKP) */

2022-10-05T22:07:20Z

HTTP Public Key Pinning (HPKP)

Michael.brownlie at 22:06, 5 October 2022

2022-10-05T22:06:52Z

Michael.brownlie: /* Certificate Recommendations and Guidance */

2022-10-05T21:57:41Z

Certificate Recommendations and Guidance

Tim.allardyce: /* Certificate Recommendations and Guidance */

2019-07-19T18:19:09Z

Certificate Recommendations and Guidance

@@ Line 2: / Line 2: @@
 ==Certificate Recommendations and Guidance==
-In support of the HTTPS Everywhere initiative, a [[Media:Recommendations for TLS Server Certificates.pdf|recommendations document]] was developed for the purpose of identifying the minimum requirements for TLS server certificate type and content, issuing CA conformance and website responsibilities that apply to all externally facing GC websites. This effort was led by TBS OCIO in close collaboration with members of the HTTPS working group including CRA, CSE, ESDC and SSC.
+In support of the HTTPS Everywhere initiative, a [https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf Recommendations for TLS Server Certificates] was developed for the purpose of identifying the minimum requirements for TLS server certificate type and content, issuing CA conformance and website responsibilities that apply to all externally facing GC websites. This effort was led by TBS OCIO in close collaboration with members of the HTTPS working group including CRA, CSE, ESDC and SSC.
 <br><br>
 While there are many technical details within the report that are not captured in this brief summary, the most important recommendations are:

@@ Line 16: / Line 16: @@
 | style="width: 500px" align="center" | [[File:Le-logo-twitter.png|250px|link=https://letsencrypt.org/]] [[file:entrust_site_seal_ssl.png|200px|link=mailto:ssc.ssltls.spc@canada.ca]]
 ||
-| style="width: 500px" align="center" | For additional information, please see [[Media:Recommendations for TLS Server Certificates.pdf|Recommendations for TLS Server Certificates]] for GC Public Facing Web Services or contact TBS-CIOB Cybersecurity ([mailto:zzTBSCybers@tbs-sct.gc.ca zzTBSCybers@tbs-sct.gc.ca])
+| style="width: 500px" align="center" | For additional information, please see [https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf Recommendations for TLS Server Certificates] for GC Public Facing Web Services or contact TBS-CIOB Cybersecurity ([mailto:zzTBSCybers@tbs-sct.gc.ca zzTBSCybers@tbs-sct.gc.ca])
 |}

@@ Line 59: / Line 59: @@
 * In the absence of HSMs, risk mitigation measures should include effective monitoring and auditing of the system so that private key compromise can be detected as early as possible followed immediately with revocation of the associated server certificate.
 <br>
-Per the [https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf Media:Recommendations for TLS Server Certificates] [[Media:Recommendations for TLS Server Certificates.pdf|Recommendations for TLS Server Certificates]] [PDF], “care must be exercised when using multi-domain and wildcard certificates to ensure collateral damage is minimized in the event of private key compromise.  Copying the same private key to multiple web servers is strongly discouraged unless appropriate risk mitigation measures are in place such as using CSE approved Hardware Security Modules to protect the private key.”
+Per the [https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf Recommendations for TLS Server Certificates] [PDF], “care must be exercised when using multi-domain and wildcard certificates to ensure collateral damage is minimized in the event of private key compromise.  Copying the same private key to multiple web servers is strongly discouraged unless appropriate risk mitigation measures are in place such as using CSE approved Hardware Security Modules to protect the private key.”
 <br><br>
 Download the Recommendations for TLS Server Certificates.pdf:

@@ Line 59: / Line 59: @@
 * In the absence of HSMs, risk mitigation measures should include effective monitoring and auditing of the system so that private key compromise can be detected as early as possible followed immediately with revocation of the associated server certificate.
 <br>
-Per the [[Media:Recommendations for TLS Server Certificates.pdf|Recommendations for TLS Server Certificates]] [PDF], “care must be exercised when using multi-domain and wildcard certificates to ensure collateral damage is minimized in the event of private key compromise.  Copying the same private key to multiple web servers is strongly discouraged unless appropriate risk mitigation measures are in place such as using CSE approved Hardware Security Modules to protect the private key.”
+Per the [https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf Media:Recommendations for TLS Server Certificates] [[Media:Recommendations for TLS Server Certificates.pdf|Recommendations for TLS Server Certificates]] [PDF], “care must be exercised when using multi-domain and wildcard certificates to ensure collateral damage is minimized in the event of private key compromise.  Copying the same private key to multiple web servers is strongly discouraged unless appropriate risk mitigation measures are in place such as using CSE approved Hardware Security Modules to protect the private key.”
 <br><br>
 Download the Recommendations for TLS Server Certificates.pdf:

@@ Line 63: / Line 63: @@
 Download the Recommendations for TLS Server Certificates.pdf:
 [[File:Pdf icon.png|75px|left|link=https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf]]
 <br><br><br><br><br>

← Older revision		Revision as of 22:07, 5 October 2022
Line 66:		Line 66:

	<br><br><br><br><br>		<br><br><br><br><br>
		+

	===HTTP Public Key Pinning (HPKP)===		===HTTP Public Key Pinning (HPKP)===

@@ Line 18: / Line 18: @@
 | style="width: 500px" align="center" | For additional information, please see [[Media:Recommendations for TLS Server Certificates.pdf|Recommendations for TLS Server Certificates]] for GC Public Facing Web Services or contact TBS-CIOB Cybersecurity ([mailto:zzTBSCybers@tbs-sct.gc.ca zzTBSCybers@tbs-sct.gc.ca])
 |}
 ===Automated Certificate Management Engine (ACME)===