What standards do certification authorities have to comply with?
Generally, in order to be accepted by a browser supplier, a certification authority (CA) must meet standards set by either the American Institute of Certified Public Accountants/Canadian Institute of Chartered Accountants (AICPA/CICA) or the (European Telecommunications Standards Institute) ETSI. The AICPA/CICA standard is called “WebTrust for CAs” and the ETSI standard is called “ETSI TS 101456 Policy requirements for certification authorities issuing qualified certificates.” These audit schemes impose requirements on the CA’s systems, personnel and procedures. But, they do not currently prescribe the specific methods used by the CA to validate the identifying information that is to be included in the certificate. With the introduction of extended validation certificates (EV SSL Certificates), WebTrust will be augmented to audit the CA’s conformance with the extended validation guidelines.
