On Oct 13, 2016, at 12:49, Kathleen Wilson <kwil...@mozilla.com> wrote:
> 1) Distrust certificates chaining up to Affected Roots with a notBefore date
> after October 21, 2016. If additional back-dating is discovered (by any
> means) to circumvent this control, then Mozilla will immediately and
> permanently revoke trust in the Affected Roots.
> -- This change will go into the Firefox 51 release train .
> -- The code will use the subject key id (hash of public key) to identify the
> Affected Roots, so that the control will also apply to cross-certs of the
> Affected Roots.
> 2) Add the previously identified backdated SHA-1 certs chaining up to the
> Affected Roots to OneCRL.
> 3) No longer accept audits carried out by Ernst & Young Hong Kong.
> 4) Remove the Affected Roots from NSS after the SSL certificates issued
> before October 1, 2016, have expired or have been replaced.
Can you clarify if the notBefore cutoff is October 1, 2016, and not October 21,
2016? There are two conflicting dates in the listed actions.
dev-security-policy mailing list