+APP.1.2.A3 Use of Trusted Certificates (B)

APP.1.2.A3 Use of Trusted Certificates (B)

If a web browser provides its own list of trusted root certificates, it MUST be ensured that only administrators can change them. If this is not possible by means of technical safeguards, users MUST be prohibited from changing this list. It MUST also be ensured that web browsers can revoke certificates locally.

Web browsers MUST comprehensively check the validity of server certificates using the public key while taking the respective validity periods into account. Web browsers MUST also verify the lock status of server certificates. The certificate chain, including the root certificate, MUST be verified.

Web browsers MUST indicate to the user in a clear and visible manner whether communication is taking place in plain text or in an encrypted manner. Web browsers SHOULD be able to show the user the server certificate in use upon request. Web browsers MUST alert the user when certificates are missing, invalid, or revoked. In such cases, the web browser in use MUST terminate the connection until the user explicitly confirms it.

1. Преглед

1.1 Препратки

1.2 Идентифицирани изисквания

1.3 Свързани регулации

2. Идентифицирани изисквания

Изисквания

3. Свързани регулации

Регулации

Свързани задачи

Връзки
blocks G 0.14 Interception of Information / Espionage
blocks G 0.19 Disclosure of Sensitive Information
blocks G 0.22 Manipulation of Information
blocks G 0.30 Unauthorised Use or Administration of Devices and Systems