Wayne - can you tell us why you think this is needed? It seems as though you think 'domain appears on a list' is a same as 'cannot issue a certificate' - can you provide you legal background and explain?
Some of us rely on these free CAs, and are not ""violating"" sanctions. You are not helping, though you think you are. Please stop. On Sunday, October 4, 2026 at 6:18:01 PM UTC+1 Wayne wrote: > Given the issues CAs have had on checking sanctioned entities against > domains I've put together an automatically updating list of unrevoked, > unexpired certificates. > > Site: https://sec-wayne.github.io/ct-sanctions-watch/ > CSV: https://sec-wayne.github.io/ct-sanctions-watch/sanctions.csv > JSON: https://sec-wayne.github.io/ct-sanctions-watch/sanctions.json > Commit history: > https://github.com/Sec-Wayne/ct-sanctions-watch/commits/main/ > > I've already been in contact with most of the CAs mentioned to give them a > more up to date blocklist. The sources are cited on the page, and > certificates are only included if it's under that CA's legal jurisdiction. > This will be an undercount, but will be replacing the regular emails CAs > have received before. > > I'll try to keep this up to date going forward. Ideally the CAs will > update their blocklists overall and make this a moot project. > > Revocations are checked regularly, and expired certificates are also > removed. There'll be a small lag on inclusion as revocation checks are > performed first. This is to cover the case of a post-issuance checks on the > CA's side finding the side and immediately revoking. > > This will be covering any CA chaining to Mozilla, Chrome, Apple, or > Microsoft via CCADB checks. > > Any questions you know how to contact me. > > - Wayne -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/922c3efd-a1d2-47a6-ad3c-9d784066c0a1n%40mozilla.org.
