CQRP Policy RC1

.github/workflows/pages.yaml

@@ -30,7 +30,7 @@ jobs:
       - name: Set up Python
         uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
-          python-version: '3.13.1'
+          python-version: '3.13'
           cache: 'pipenv'
 
       # Install pipenv

Pipfile

@@ -12,4 +12,3 @@ pyyaml = "*"
 
 [requires]
 python_version = "3.13"
-python_full_version = "3.13.1"

content/cqrp/disclosures/ari-operational-test-report.json

@@ -1,5 +1,5 @@
 {
-  "$schema": "https://github.com/GoogleChrome/chromerootprogram/tree/main/content/cqrp/disclosures/ari-operational-test-report.schema.json",
+  "$schema": "https://github.com/GoogleChrome/chromerootprogram/blob/main/content/cqrp/disclosures/ari-operational-test-report.schema.json",
   "test_cycle_id": "2026-Q3-ARI-TEST-01",
   "sample_selection": {
     "timestamp": "2026-08-05T00:00:00Z",
@@ -18,10 +18,10 @@
       {
         "software": "Certbot",
         "version": "2.6.0",
-        "total": 500,
-        "passed": 490,
-        "failed": 10,
-        "pass_rate_percentage": 98.0
+        "total": 800,
+        "passed": 760,
+        "failed": 40,
+        "pass_rate_percentage": 95.0
       },
       {
         "software": "acme.sh",
@@ -43,39 +43,26 @@
   },
   "results": [
     {
-      "serial_number": "03A4F891BCDE0012",
+      "serial_number": "100000",
       "issuance_log_entry_index": 1048576,
       "ari_renewal_window": {
         "start": "2026-08-05T12:00:00Z",
         "end": "2026-08-08T12:00:00Z"
       },
       "outcome": "pass",
-      "user_agent": "Certbot/2.6.0 (Ubuntu 22.04; certbot-ari-plugin/0.1.0)",
-      "parsed_client": {
-        "name": "Certbot",
-        "version": "2.6.0"
-      },
-      "user_agent_source": "renewal_request",
       "renewal_timestamp": "2026-08-05T16:00:00Z",
       "time_to_renewal_seconds": 14400
     },
     {
-      "serial_number": "03A4F891BCDE0013",
+      "serial_number": "100001",
       "issuance_log_entry_index": 1048577,
       "ari_renewal_window": {
         "start": "2026-08-05T12:00:00Z",
         "end": "2026-08-08T12:00:00Z"
       },
       "outcome": "fail",
-      "user_agent": "legacy-acme-client/1.0.0",
-      "parsed_client": {
-        "name": "legacy-acme-client",
-        "version": "1.0.0"
-      },
-      "user_agent_source": "initial_issuance",
       "renewal_timestamp": null,
       "time_to_renewal_seconds": null
     }
   ]
 }
-

content/cqrp/disclosures/ari-operational-test-report.schema.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GoogleChrome/chromerootprogram/tree/main/content/cqrp/disclosures/ari-operational-test-report.schema.json",
+  "$id": "https://github.com/GoogleChrome/chromerootprogram/blob/main/content/cqrp/disclosures/ari-operational-test-report.schema.json",
   "title": "MTC CA Operational ARI Test Report Schema",
   "description": "Schema for reporting quarterly operational ACME Renewal Information (ARI) client responsiveness test cycles.",
   "type": "object",
@@ -65,9 +65,9 @@
         },
         "sample_percentage": {
           "type": "number",
-          "minimum": 3.0,
+          "exclusiveMinimum": 0.0,
           "maximum": 100.0,
-          "description": "Percentage of eligible certificates sampled (MUST be at least 3.0%)."
+          "description": "Percentage of eligible certificates sampled (SHOULD be at least 3.0%, unless the 100,000-certificate cap applies)."
         }
       },
       "additionalProperties": false
@@ -138,9 +138,6 @@
           "issuance_log_entry_index",
           "ari_renewal_window",
           "outcome",
-          "user_agent",
-          "parsed_client",
-          "user_agent_source",
           "renewal_timestamp",
           "time_to_renewal_seconds"
         ],
@@ -168,23 +165,6 @@
             "type": "string",
             "enum": ["pass", "fail"]
           },
-          "user_agent": {
-            "type": "string",
-            "description": "Full untruncated HTTP User-Agent request header string."
-          },
-          "parsed_client": {
-            "type": "object",
-            "required": ["name", "version"],
-            "properties": {
-              "name": { "type": "string", "minLength": 1 },
-              "version": { "type": "string", "minLength": 1 }
-            },
-            "additionalProperties": false
-          },
-          "user_agent_source": {
-            "type": "string",
-            "enum": ["renewal_request", "initial_issuance"]
-          },
           "renewal_timestamp": {
             "type": ["string", "null"],
             "format": "date-time",
@@ -201,5 +181,3 @@
   },
   "additionalProperties": false
 }
-
-

content/cqrp/disclosures/mtc-disclosures.json

@@ -1,33 +1,66 @@
 {
-  "$schema": "https://github.com/GoogleChrome/chromerootprogram/tree/main/content/cqrp/disclosures/mtc-disclosures.schema.json",
+  "$schema": "https://github.com/GoogleChrome/chromerootprogram/blob/main/content/cqrp/disclosures/mtc-disclosures.schema.json",
   "operator_name": "Example Security CA Inc.",
   "last_updated": "2026-08-05T10:00:00Z",
   "global_disclosures": {
     "ca_repository_url": "https://github.com/example-ca/pki-repository",
     "legal_entity_and_ownership_url": "https://example-ca.com/legal/ownership-and-control.html",
-    "status_and_incidents_url": "https://status.example-ca.com",
+    "operational_status_url": "https://status.example-ca.com",
     "facility_certification_url": "https://example-ca.com/compliance/iso27001-global.pdf"
   },
   "ca_cosigner_keys": [
     {
-      "friendly_name": "Example MTC CA 2026 7-Day Key 1",
+      "friendly_name": "Example MTC CA 2026 7-Day Active Key 1",
       "key_sha256": "40328aac349197c2daccd7b8ca66b17f3e44d2d5fa66acc7d0a8c2924802fbfa",
       "disclosures": {
-        "policy_documents_url": "https://github.com/example-ca/pki-repository/blob/main/CPS-7day.md",
-        "reserve_keys_url": "https://github.com/example-ca/pki-repository/blob/main/upcoming_keys_7day.json",
+        "policy_documents_url": "https://github.com/example-ca/pki-repository/blob/main/CP-CPS.md",
+        "reserve_keys_url": "https://github.com/example-ca/pki-repository/blob/main/reserve_keys.json",
         "key_generation_attestation_url": "https://example-ca.com/audits/2026-key1-attestation.pdf",
-        "infrastructure_architecture_url": "https://github.com/example-ca/pki-repository/blob/main/arch-key1.md"
+        "infrastructure_architecture_url": "https://github.com/example-ca/pki-repository/blob/main/arch-key1.md",
+        "full_crl_urls": [
+          "http://crl.example-ca.com/mtc-2026-7day-key1.crl"
+        ],
+        "partitioned_crl_urls": []
       }
     },
     {
-      "friendly_name": "Example MTC CA 2026 47-Day Key 2",
+      "friendly_name": "Example MTC CA 2026 47-Day Active Key 2",
       "key_sha256": "8f3b211a549197c2daccd7b8ca66b17f3e44d2d5fa66acc7d0a8c2924802eabc",
       "disclosures": {
-        "policy_documents_url": "https://github.com/example-ca/pki-repository/blob/main/CPS-47day.md",
-        "reserve_keys_url": "https://github.com/example-ca/pki-repository/blob/main/upcoming_keys_47day.json",
+        "policy_documents_url": "https://github.com/example-ca/pki-repository/blob/main/CP-CPS.md",
+        "reserve_keys_url": "https://github.com/example-ca/pki-repository/blob/main/reserve_keys.json",
         "key_generation_attestation_url": "https://example-ca.com/audits/2026-key2-attestation.pdf",
         "infrastructure_architecture_url": "https://github.com/example-ca/pki-repository/blob/main/arch-key2.md",
-        "facility_certification_url": "https://example-ca.com/compliance/iso27001-secondary-dc.pdf"
+        "facility_certification_url": "https://example-ca.com/compliance/iso27001-secondary-dc.pdf",
+        "full_crl_urls": [],
+        "partitioned_crl_urls": [
+          "http://crl.example-ca.com/mtc-2026-47day-key2-p1.crl",
+          "http://crl.example-ca.com/mtc-2026-47day-key2-p2.crl"
+        ]
+      }
+    },
+    {
+      "friendly_name": "Example MTC CA 2026 Reserve Key 1",
+      "key_sha256": "c19a440b712397c2daccd7b8ca66b17f3e44d2d5fa66acc7d0a8c29248029901",
+      "disclosures": {
+        "policy_documents_url": "https://github.com/example-ca/pki-repository/blob/main/CP-CPS.md",
+        "reserve_keys_url": "https://github.com/example-ca/pki-repository/blob/main/reserve_keys.json",
+        "key_generation_attestation_url": "https://example-ca.com/audits/2026-reserve1-attestation.pdf",
+        "infrastructure_architecture_url": "https://github.com/example-ca/pki-repository/blob/main/arch-reserve1.md",
+        "full_crl_urls": [],
+        "partitioned_crl_urls": []
+      }
+    },
+    {
+      "friendly_name": "Example MTC CA 2026 Reserve Key 2",
+      "key_sha256": "d28b551c823497c2daccd7b8ca66b17f3e44d2d5fa66acc7d0a8c29248029902",
+      "disclosures": {
+        "policy_documents_url": "https://github.com/example-ca/pki-repository/blob/main/CP-CPS.md",
+        "reserve_keys_url": "https://github.com/example-ca/pki-repository/blob/main/reserve_keys.json",
+        "key_generation_attestation_url": "https://example-ca.com/audits/2026-reserve2-attestation.pdf",
+        "infrastructure_architecture_url": "https://github.com/example-ca/pki-repository/blob/main/arch-reserve2.md",
+        "full_crl_urls": [],
+        "partitioned_crl_urls": []
       }
     }
   ]

content/cqrp/disclosures/mtc-disclosures.schema.json

@@ -1,14 +1,13 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://github.com/GoogleChrome/chromerootprogram/tree/main/content/cqrp/disclosures/mtc-disclosures.schema.json",
+  "$id": "https://github.com/GoogleChrome/chromerootprogram/blob/main/content/cqrp/disclosures/mtc-disclosures.schema.json",
   "title": "MTC CA Operator Disclosures Schema",
-  "description": "Schema for MTC CA Operator disclosures supporting per-key and global disclosure URLs.",
+  "description": "Schema for MTC CA and Mirroring Operator disclosures supporting per-key and global disclosure URLs.",
   "type": "object",
   "required": [
     "operator_name",
     "last_updated",
-    "global_disclosures",
-    "ca_cosigner_keys"
+    "global_disclosures"
   ],
   "properties": {
     "$schema": {
@@ -17,7 +16,8 @@
     },
     "operator_name": {
       "type": "string",
-      "description": "Legal name of the MTC CA Operator."
+      "minLength": 1,
+      "description": "Legal name of the Operator."
     },
     "last_updated": {
       "type": "string",
@@ -26,40 +26,39 @@
     },
     "global_disclosures": {
       "type": "object",
-      "description": "Operator-wide disclosures applicable across all CA Cosigner Keys.",
+      "description": "Operator-wide disclosures applicable across all operations and CA Cosigner Keys.",
       "required": [
         "ca_repository_url",
         "legal_entity_and_ownership_url",
-        "status_and_incidents_url",
-        "facility_certification_url"
+        "operational_status_url"
       ],
       "properties": {
         "ca_repository_url": {
           "type": "string",
           "format": "uri",
-          "description": "URL to the CA Operator's public repository where items like policy documents, Subscriber agreements, and historical revisions reside."
+          "description": "URL to the Operator's public repository where items like policy documents, Subscriber agreements, certificate profiles, and historical revisions reside."
         },
         "legal_entity_and_ownership_url": {
           "type": "string",
           "format": "uri",
           "description": "URL detailing legal entity status, beneficial ownership, and corporate control."
         },
-        "status_and_incidents_url": {
+        "operational_status_url": {
           "type": "string",
           "format": "uri",
-          "description": "URL to public operational status and incident reporting pages."
+          "description": "URL to public operational status reporting pages."
         },
         "facility_certification_url": {
           "type": "string",
           "format": "uri",
-          "description": "URL to ISO/IEC 27001 or equivalent facility audit certification."
+          "description": "URL to ISO/IEC 27001, AICPA SOC 2 Type II / SOC 3, or equivalent facility audit certification. Required when applying or operating as an MTC CA Operator."
         }
       },
       "additionalProperties": false
     },
     "ca_cosigner_keys": {
       "type": "array",
-      "description": "List of disclosures specific to each CA Cosigner Key operated by the CA.",
+      "description": "List of disclosures specific to each CA Cosigner Key included in the CQRS. May be omitted by applicants initially onboarding solely as a Mirroring Operator.",
       "minItems": 1,
       "items": {
         "type": "object",
@@ -71,27 +70,30 @@
         "properties": {
           "friendly_name": {
             "type": "string",
+            "minLength": 1,
             "description": "Human-readable name for the CA Cosigner Key."
           },
           "key_sha256": {
             "type": "string",
             "pattern": "^[a-fA-F0-9]{64}$",
-            "description": "Hex-encoded SHA-256 hash of the CA Cosigner Key public key."
+            "description": "Hex-encoded SHA-256 hash of the CA Cosigner Key's DER-encoded SubjectPublicKeyInfo (SPKI)."
           },
           "disclosures": {
             "type": "object",
-            "description": "Key-specific disclosure URLs.",
+            "description": "Key-specific disclosure URLs and CRL Distribution Points.",
             "required": [
               "policy_documents_url",
               "reserve_keys_url",
               "key_generation_attestation_url",
-              "infrastructure_architecture_url"
+              "infrastructure_architecture_url",
+              "full_crl_urls",
+              "partitioned_crl_urls"
             ],
             "properties": {
               "policy_documents_url": {
                 "type": "string",
                 "format": "uri",
-                "description": "URL to the Markdown/AsciiDoc CPS for this specific key."
+                "description": "URL to the Markdown/AsciiDoc combined CP/CPS governing this key."
               },
               "reserve_keys_url": {
                 "type": "string",
@@ -112,6 +114,26 @@
                 "type": "string",
                 "format": "uri",
                 "description": "Optional override URL for facility certification if this key is hosted in a distinct facility."
+              },
+              "full_crl_urls": {
+                "type": "array",
+                "description": "Array of HTTP URLs for all Full (complete) CRLs issued by this CA Cosigner Key. MUST be an empty array ([]) if this key only issues partitioned CRLs or is an offline Reserve key.",
+                "items": {
+                  "type": "string",
+                  "format": "uri",
+                  "pattern": "^http://"
+                },
+                "uniqueItems": true
+              },
+              "partitioned_crl_urls": {
+                "type": "array",
+                "description": "Array of HTTP URLs for all Partitioned CRLs issued by this CA Cosigner Key. MUST be an empty array ([]) if this key only issues full CRLs or is an offline Reserve key.",
+                "items": {
+                  "type": "string",
+                  "format": "uri",
+                  "pattern": "^http://"
+                },
+                "uniqueItems": true
               }
             },
             "additionalProperties": false
@@ -121,5 +143,19 @@
       }
     }
   },
+  "if": {
+    "required": [
+      "ca_cosigner_keys"
+    ]
+  },
+  "then": {
+    "properties": {
+      "global_disclosures": {
+        "required": [
+          "facility_certification_url"
+        ]
+      }
+    }
+  },
   "additionalProperties": false
 }