On 24/08/16 14:08, Gervase Markham wrote: > * The issuance of certificates using SHA-1 has been banned by the > Baseline Requirements since January 1st, 2016. Browsers, including > Firefox, planned to enforce this[2] by not trusting certs with a > notBefore date after that date, but in the case of Firefox the fix had > to be backed out due to web compatibility issues.
Just as a note, this information is incomplete - the enforcement returned for publicly-trusted CAs in bug https://bugzilla.mozilla.org/show_bug.cgi?id=1254667 , since Firefox 48. Gerv _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy