Becoming a Root CA or a Trusted Intermediate CA?

[Sir Asvald]

I know it sounds crazy and it probably involves a LOT of MONEY and time. I'm not sure if anyone can answer my question.. I wanted to know what is the process? How long does it take to become one? The audit process, what do they check?

 

Cheers.

 

 

[MotionFlex]

Here are two links which may be a starting point:
 

https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/

 

https://technet.microsoft.com/en-us/library/cc751157.aspx

 

(Source: https://webmasters.stackexchange.com/a/9873)

[Meic]

The sale of Symantec's CA to DigiCert was ~$1 Billion...

 

Quote

DigiCert completed its billion-dollar purchase of Symantec's former certificate business.

https://www.zdnet.com/article/comodo-ca-sold-to-private-equity-as-digicert-completes-symantec-ca-purchase/

[Sir Asvald]

2 hours ago, Meic said:

The sale of Symantec's CA to DigiCert was ~$1 Billion...

 

https://www.zdnet.com/article/comodo-ca-sold-to-private-equity-as-digicert-completes-symantec-ca-purchase/

Nothing to do with my question.. Company was bought OUT. I'm asking how much does it cost to become ONE.

[Meic]

2 hours ago, Abdul201588 said:

Company was bought OUT. I'm asking how much does it cost to become ONE.

Buying one is a way to become one....

[Sir Asvald]

52 minutes ago, Meic said:

Buying one is a way to become one....

No. Just no. You don't know what you're talking about.. 

[Mikensan]

Your real question is how much do you have to pay Microsoft/Google/Mozilla to include your root CA. I'm sure there's a PKI standard you will both have to meet and prove through an accreditation process. You also will likely need multiple employees, RAs and TAs to meet those requirements.

 

Letsencrypt just started up not too long ago, and they required the backing of global tech giants to get started. Here's an idea of how much it costs to run a CA at least:

https://letsencrypt.org/2016/09/20/what-it-costs-to-run-lets-encrypt.html

 

I tried to find some history on how they started up but turned up empty handed. It's much easier to just create your own CA and hand out your root cert to those that will be using it, and then use Letsencrypt for any internet/external facing services. This is exactly what I'm doing for my personal lab, and have my root CA installed on all my mobile devices and computers.

 

M$ guidelines:

https://technet.microsoft.com/en-us/library/cc751157.aspx

[LAwLz]

22 hours ago, Abdul201588 said:

I know it sounds crazy and it probably involves a LOT of MONEY and time. I'm not sure if anyone can answer my question.. I wanted to know what is the process? How long does it take to become one? The audit process, what do they check?

 

Cheers.

There isn't really a process that you just follow and then you become one.

You have to either buy an already established CA or create connections with all the major software players and have them ship with your cert.

 

It's not really about time or money, as much as it is connections and relations dependent.