On 2015-05-14 17:25, Gervase Markham wrote:
2) "If it is different, does name-constraining government CAs make things better, or not?"
I think it only makes sense to name constrain a government CA if the name constrained only covers government websites, and not all websites in the country. Examples would be covering *.gov and *.go.jp. I think that restricting them to *.jp, *.in, *.cn and so on doesn't actually add enough value.
I would also like to point out that even when you have a government CA for certain things that not all websites need to chain to the government CA but that they can buy certificates from a commercial CA too.
Kurt _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
