On Wed, Nov 02, 2016 at 09:50:41PM -0700, Han Yuwei wrote: > 在 2016年9月10日星期六 UTC+8下午8:37:40，Han Yuwei写道： > > I am using Cloudflare's DNS service and I found that Cloudflare has issued > > a certficate to their server including my domain. But I didn't use any SSL > > service of theirs. Is that ok to Mozilla's policy? > > > > Issued certificate:https://crt.sh/?id=31206531 > > My domain is BUPT.MOE > > Thanks for your time. > > My question remains that, > 1. If I request Comodo to revoke the certificate, how is it likely to be > approved?
Extremely close to zero. > 2. If Cloudflare use this certificate to perform MITM, how can others know > about it? Cloudflare *do* use their certificates to perform MitM, that's their entire business model. > 3. Is this concerned by Mozilla? If it isn't, I wouldn't post anything about > it anymore. I don't speak for Mozilla, but I haven't seen anyone from Mozilla express concern about the actions of Comodo in this case, and I don't know of any aspect of Mozilla policies which this behaviour violates. - Matt _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
