FYI - still looking into this. I should have a report tomorrow. -----Original Message----- From: dev-security-policy [mailto:dev-security-policy-bounces+jeremy.rowley=digicert....@lists.mozilla.org] On Behalf Of Jeremy Rowley via dev-security-policy Sent: Wednesday, April 19, 2017 2:27 PM To: [email protected]; Mike vd Ent <[email protected]> Cc: Ben Wilson <[email protected]>; mozilla-dev-security-policy <[email protected]> Subject: RE: CA Validation quality is failing
I’m looking into it right now. I’ll report back shortly. Jeremy From: Ryan Sleevi [mailto:[email protected]] Sent: Wednesday, April 19, 2017 2:25 PM To: Mike vd Ent <[email protected]> Cc: mozilla-dev-security-policy <[email protected]>; Jeremy Rowley <[email protected]>; Ben Wilson <[email protected]> Subject: Re: CA Validation quality is failing On Wed, Apr 19, 2017 at 3:47 PM, Mike vd Ent via dev-security-policy <[email protected] <mailto:[email protected]> > wrote: Ryan, My answers on the particular issues are stated inline. But the thing I want to address is how could (in this case Digicert) validate such data and issues certificates? I am investigation more of them and afraid even linked company names or registration numbers could be false. Shouldn't those certificates be revoked? You are correct that it appears these certificates should not have issued. Hopefully Jeremy and Ben from DigiCert can comment on this thread ( https://groups.google.com/d/msg/mozilla.dev.security.policy/DgeLqKMzIds/ig8UmHT2DwAJ for the archive) with details about the issues and the steps taken.
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
