95
edits
Changes
GC HTTPS Certificate Guidance (view source)
Revision as of 17:13, 5 October 2022
, 17:13, 5 October 2022no edit summary
==Certificate Recommendations and Guidance==
==Certificate Recommendations and Guidance==
In support of the HTTPS Everywhere initiative, a [[Media:Recommendations for TLS Server Certificates.pdf|recommendations document]] was developed for the purpose of identifying the minimum requirements for TLS server certificate type and content, issuing CA conformance and website responsibilities that apply to all externally facing GC websites. This effort was led by TBS OCIO in close collaboration with members of the HTTPS working group including CRA, CSE, ESDC and SSC.
In support of the HTTPS Everywhere initiative, a [https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf Recommendations for TLS Server Certificates] was developed for the purpose of identifying the minimum requirements for TLS server certificate type and content, issuing CA conformance and website responsibilities that apply to all externally facing GC websites. This effort was led by TBS OCIO in close collaboration with members of the HTTPS working group including CRA, CSE, ESDC and SSC.
<br><br>
<br><br>
While there are many technical details within the report that are not captured in this brief summary, the most important recommendations are:
While there are many technical details within the report that are not captured in this brief summary, the most important recommendations are:
|-
|-
| style="width: 500px" align="center" | [[File:Le-logo-twitter.png|250px|link=https://letsencrypt.org/]] [[file:entrust_site_seal_ssl.png|200px|link=mailto:ssc.ssltls.spc@canada.ca]]
| style="width: 500px" align="center" | [[File:Le-logo-twitter.png|250px|link=https://letsencrypt.org/]] [[file:entrust_site_seal_ssl.png|200px|link=mailto:ssc.ssltls.spc@canada.ca]]
|| For additional information, please see [[Media:Recommendations for TLS Server Certificates.pdf|Recommendations for TLS Server Certificates]] for GC Public Facing Web Services or contact TBS-CIOB Cybersecurity ([mailto:zzTBSCybers@tbs-sct.gc.ca zzTBSCybers@tbs-sct.gc.ca])
||
| style="width: 500px" align="center" | For additional information, please see [https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf Recommendations for TLS Server Certificates] for GC Public Facing Web Services or contact TBS-CIOB Cybersecurity ([mailto:zzTBSCybers@tbs-sct.gc.ca zzTBSCybers@tbs-sct.gc.ca])
|}
|}
<br>
===Enterprise Certificate Management===
Recently the National Institute of Standards and Technology released [https://www.nccoe.nist.gov/projects/building-blocks/tls-server-certificate-management Special Publication 1800-16 Securing Web Transactions: TLS Server Certificate Management] for public comment. This draft practice guide provides additional information for enterprises that rely on Transport Layer Security (TLS) to secure both customer-facing and internal applications, so they can better manage TLS server certificates by:
* Defining operational and security policies; identifying roles and responsibilities
* Establishing comprehensive certificate inventories and ownership tracking
* Conducting continuous monitoring of certificate operational and security status
* Automating certificate management to minimize human error and maximize efficiency on a large scale
* Enabling rapid migration to new certificates and keys when cryptographic mechanisms are found to be weak, compromised or vulnerable
<Br>
===Automated Certificate Management Engine (ACME)===
===Automated Certificate Management Engine (ACME)===
<u>[https://tools.ietf.org/html/rfc8555 RFC 8555: Automatic Certificate Management Environment]</u><br>
<u>[https://tools.ietf.org/html/rfc8555 RFC 8555: Automatic Certificate Management Environment]</u><br>
<br>
<br>
||
||
[[File:ACME-protocol-icon.png|220px|frameless]]
| style="width: 500px" align="center" |[[File:ACME-protocol-icon.png|220px|frameless]]
|}
|}
* In the absence of HSMs, risk mitigation measures should include effective monitoring and auditing of the system so that private key compromise can be detected as early as possible followed immediately with revocation of the associated server certificate.
* In the absence of HSMs, risk mitigation measures should include effective monitoring and auditing of the system so that private key compromise can be detected as early as possible followed immediately with revocation of the associated server certificate.
<br>
<br>
Per the [[Media:Recommendations for TLS Server Certificates.pdf|Recommendations for TLS Server Certificates]] [PDF], “care must be exercised when using multi-domain and wildcard certificates to ensure collateral damage is minimized in the event of private key compromise. Copying the same private key to multiple web servers is strongly discouraged unless appropriate risk mitigation measures are in place such as using CSE approved Hardware Security Modules to protect the private key.”
Per the [https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf Recommendations for TLS Server Certificates] [PDF], “care must be exercised when using multi-domain and wildcard certificates to ensure collateral damage is minimized in the event of private key compromise. Copying the same private key to multiple web servers is strongly discouraged unless appropriate risk mitigation measures are in place such as using CSE approved Hardware Security Modules to protect the private key.”
<br><br>
<br><br>
Download the Recommendations for TLS Server Certificates.pdf:
Download the Recommendations for TLS Server Certificates.pdf:
[[File:Pdf icon.png|75px|left|link=https://wiki.gccollab.ca/images/8/89/Recommendations_for_TLS_Server_Certificates.pdf]]
[[File:Pdf icon.png|75px|left|link=https://wiki.gccollab.ca/images/9/92/Recommendations_for_TLS_Server_Certificates_-_14_May_2021.pdf]]
<br><br><br><br><br>
<br><br><br><br><br>