It's definitely not the place to discuss individual CAs. The CAB Forum
creates guidelines but, intentionally and by design, is not an enforcement
or root management authority. The CAB Forum can set policies about CAs, but
the browsers retain the sole right to decide what penalties are appropriate
for violating the policy. 

-----Original Message-----
From: dev-security-policy
.org] On Behalf Of Peter Gutmann
Sent: Saturday, October 15, 2016 2:31 AM
To: Erwann Abalea <>;
Subject: Re: StartCom & Qihoo Incidents

Erwann Abalea <> writes:

>And that's not CABF's duty and responsibility. What the CABF can impose 
>to CABF members is to follow the bylaws, the internal governance rules. 
>By following them, all members write the guidelines and decide on what 
>changes to adopt, and browsers then impose CAs to follow these guidelines.

Hmm, OK.  I was just wondering why the CABF seemed to be missing in action,
since it appeared to be the logical place to address this sort of issue.

>What appears from the CABF meeting minutes is that the 
>WoSign+StartCom+Qihoo combination is looked after, precisely regarding the

Hmm, I'm not quite sure what you mean by that, but a quick check of the most
recently published minutes:

indicate that not much has happened, there's just a brief comment about
whether { WoSign, Startcom, Qihoo 360 } should be treated as one entity or
three.  I assume that's the bylaw issue?

So there really is no-one running the show, meaning no coordinating body
that can say "bad things are happening over here, you need to take action to
deal with them"?  It just seems odd that the next time a CA goes rogue,
every end user on the planet has to wait for whatever browser vendor they
rely on to make some arbitrary decision on what to do, or as it seems for
many vendors in the case of WoSign, do nothing.  The only one who's openly
addressed this seems to be Mozilla.

dev-security-policy mailing list

Attachment: smime.p7s
Description: S/MIME cryptographic signature

dev-security-policy mailing list

Reply via email to