On 20/04/17 14:46, Gervase Markham wrote: > So, proposed new text: > > "CAs MUST revoke Certificates that they have issued upon the > occurrence of any event listed in the appropriate subsection of section > 4.9.1 of the Baseline Requirements (for email certificates, not > including those events specific to the inclusion of Domain Names)."
Edit made as follows: "CAs MUST revoke Certificates that they have issued upon the occurrence of any event listed in the appropriate subsection of section 4.9.1 of the Baseline Requirements, according to the timeline defined therein." I added the note about timeline because it's possible that the Forum may be updating those rules soon to be a bit more flexible, and I wouldn't want it to seem like the Mozilla policy requires immediate revocation. Gerv _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
