On Tue, Oct 6, 2026 at 12:33 PM Mike Shaver <[email protected]> wrote: > > Yes, this is about policy violations that happen to be sanction-related: the > CAs say they don’t issue to sanctioned-by-whoever entities, and these are > cases where a CA has—perhaps inadvertently—issued to a sanctioned entity. > > You can think of it the same way as if this were “vowel watch” for CAs that > said “we will never issue to entities with names that contain vowels” but > have nonetheless done so. The tool is a way to help the relevant CAs in > avoiding or revoking issuance that is counter to their published policies.
Does that include maters lectionis? Unicode/linguistics jokes/special cases aside, issuance to an entity whose SAN contains a vowel when they say they won't is a fairly easily determinable fact. Issuance to a "sanctioned" entity is a much more complicated issue, with potential licenses, disputes over the scope of sanctions, similarly named entities, etc. I think avoiding putting these these statements in CPS etc. is the way to go. Sincerely, Watson > > Mike > > On Tue, Oct 6, 2026 at 12:36 PM K. York <[email protected]> wrote: >> >> The website is quite clear that only sanctions regimes covering the CA's >> legal entity are being checked for -- US CAs use the US list, EU CAs use the >> EU list, etc. >> >> ~Kane >> >> Sent with Shortwave >> >> On Tue Oct 6, 2026, 04:03 PM GMT, Arabella Barks wrote: >> >> I also strongly oppose the define of "sanction". >> >> Every region, political regime or coalition defines what is "legal" >> differently. >> >> >> >> For example, someone undemocratic government designate human rights >> organizations as illegal. Should we consider banning all CAs worldwide from >> issuing SSL certificates for these organizations to comply with the wishes >> of such government? >> >> On Tuesday, October 6, 2026 at 5:19:15 AM UTC+8 Wayne wrote: >>> >>> If you believe an entity, domain, or certificate is mislabeled then I'm >>> happy to investigate. Otherwise these are all tools that every CA has in >>> their usage, I'm just making sure we're all using up to date lists and >>> applying them equally. >>> >>> Every source has been provided, it should help you if you disagree with my >>> assessment. >>> >>> On Monday, October 5, 2026 at 10:07:27 PM UTC+1 Max wrote: >>>> >>>> Wayne - can you tell us why you think this is needed? >>>> >>>> It seems as though you think 'domain appears on a list' is a same as >>>> 'cannot issue a certificate' - can you provide you legal background and >>>> explain? >>>> >>>> Some of us rely on these free CAs, and are not ""violating"" sanctions. >>>> >>>> You are not helping, though you think you are. >>>> >>>> Please stop. >>>> >>>> On Sunday, October 4, 2026 at 6:18:01 PM UTC+1 Wayne wrote: >>>>> >>>>> Given the issues CAs have had on checking sanctioned entities against >>>>> domains I've put together an automatically updating list of unrevoked, >>>>> unexpired certificates. >>>>> >>>>> Site: https://sec-wayne.github.io/ct-sanctions-watch/ >>>>> CSV: https://sec-wayne.github.io/ct-sanctions-watch/sanctions.csv >>>>> JSON: https://sec-wayne.github.io/ct-sanctions-watch/sanctions.json >>>>> Commit history: >>>>> https://github.com/Sec-Wayne/ct-sanctions-watch/commits/main/ >>>>> >>>>> I've already been in contact with most of the CAs mentioned to give them >>>>> a more up to date blocklist. The sources are cited on the page, and >>>>> certificates are only included if it's under that CA's legal >>>>> jurisdiction. This will be an undercount, but will be replacing the >>>>> regular emails CAs have received before. >>>>> >>>>> I'll try to keep this up to date going forward. Ideally the CAs will >>>>> update their blocklists overall and make this a moot project. >>>>> >>>>> Revocations are checked regularly, and expired certificates are also >>>>> removed. There'll be a small lag on inclusion as revocation checks are >>>>> performed first. This is to cover the case of a post-issuance checks on >>>>> the CA's side finding the side and immediately revoking. >>>>> >>>>> This will be covering any CA chaining to Mozilla, Chrome, Apple, or >>>>> Microsoft via CCADB checks. >>>>> >>>>> Any questions you know how to contact me. >>>>> >>>>> - Wayne >> >> -- >> You received this message because you are subscribed to the Google Groups >> "[email protected]" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To view this discussion visit >> https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/69ad6b3e-4dab-466a-987c-f277b59fa475n%40mozilla.org. >> >> -- >> You received this message because you are subscribed to the Google Groups >> "[email protected]" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to [email protected]. >> To view this discussion visit >> https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/b77de32f-041f-4243-a324-c5729500c855%40mail.shortwave.com. > > -- > You received this message because you are subscribed to the Google Groups > "[email protected]" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > To view this discussion visit > https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/CADQzZqtqh7Lot_RGLWvxk-GWp5jR16uJdhE7UATKV76c4GUn4A%40mail.gmail.com. -- Astra mortemque praestare gradatim -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/CACsn0c%3Da_RJvtMxda30P%2BEjYFWc3AWe4ZRX9E7DsO_nL0oSfZA%40mail.gmail.com.
