The website is quite clear that only sanctions regimes covering the CA's legal entity are being checked for -- US CAs use the US list, EU CAs use the EU list, etc.
~Kane Sent with Shortwave <https://www.shortwave.com?utm_medium=email&utm_content=signature&utm_source=a2FuZXB5b3JrQGdtYWlsLmNvbQ==> On Tue Oct 6, 2026, 04:03 PM GMT, Arabella Barks <mailto:[email protected]> wrote: > I also strongly oppose the define of "sanction". > > Every region, political regime or coalition defines what is "legal" > differently. > > > > For example, someone undemocratic government designate human rights > organizations as illegal. Should we consider banning all CAs worldwide from > issuing SSL certificates for these organizations to comply with the wishes of > such government? > On Tuesday, October 6, 2026 at 5:19:15 AM UTC+8 Wayne wrote: >> If you believe an entity, domain, or certificate is mislabeled then I'm >> happy to investigate. Otherwise these are all tools that every CA has in >> their usage, I'm just making sure we're all using up to date lists and >> applying them equally. >> >> Every source has been provided, it should help you if you disagree with my >> assessment. >> >> On Monday, October 5, 2026 at 10:07:27 PM UTC+1 Max wrote: >>> Wayne - can you tell us why you think this is needed? >>> >>> It seems as though you think 'domain appears on a list' is a same as >>> 'cannot issue a certificate' - can you provide you legal background and >>> explain? >>> >>> Some of us rely on these free CAs, and are not ""violating"" sanctions. >>> >>> You are not helping, though you think you are. >>> >>> Please stop. >>> >>> On Sunday, October 4, 2026 at 6:18:01 PM UTC+1 Wayne wrote: >>>> Given the issues CAs have had on checking sanctioned entities against >>>> domains I've put together an automatically updating list of unrevoked, >>>> unexpired certificates. >>>> >>>> Site: https://sec-wayne.github.io/ct-sanctions-watch/ >>>> <https://sec-wayne.github.io/ct-sanctions-watch/> >>>> CSV: https://sec-wayne.github.io/ct-sanctions-watch/sanctions.csv >>>> <https://sec-wayne.github.io/ct-sanctions-watch/sanctions.csv> >>>> JSON: https://sec-wayne.github.io/ct-sanctions-watch/sanctions.json >>>> <https://sec-wayne.github.io/ct-sanctions-watch/sanctions.json> >>>> Commit history: >>>> https://github.com/Sec-Wayne/ct-sanctions-watch/commits/main/ >>>> <https://github.com/Sec-Wayne/ct-sanctions-watch/commits/main/> >>>> >>>> I've already been in contact with most of the CAs mentioned to give them a >>>> more up to date blocklist. The sources are cited on the page, and >>>> certificates are only included if it's under that CA's legal jurisdiction. >>>> This will be an undercount, but will be replacing the regular emails CAs >>>> have received before. >>>> >>>> I'll try to keep this up to date going forward. Ideally the CAs will >>>> update their blocklists overall and make this a moot project. >>>> >>>> Revocations are checked regularly, and expired certificates are also >>>> removed. There'll be a small lag on inclusion as revocation checks are >>>> performed first. This is to cover the case of a post-issuance checks on >>>> the CA's side finding the side and immediately revoking. >>>> >>>> This will be covering any CA chaining to Mozilla, Chrome, Apple, or >>>> Microsoft via CCADB checks. >>>> >>>> Any questions you know how to contact me. >>>> >>>> - Wayne > -- > You received this message because you are subscribed to the Google Groups > "[email protected]" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] > <mailto:[email protected]>. > To view this discussion visit > https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/69ad6b3e-4dab-466a-987c-f277b59fa475n%40mozilla.org > > <https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/69ad6b3e-4dab-466a-987c-f277b59fa475n%40mozilla.org?utm_medium=email&utm_source=footer>. -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/b77de32f-041f-4243-a324-c5729500c855%40mail.shortwave.com.
