BR compliance of legacy certs at root inclusion time

[Nick Lamb via dev-security-policy]

I'll speak up for transparency again. In terms of policy the most vital thing 
is that a CA tells us about such certs during application. One way to do that 
would be to CT log them, but especially for small sets there might be other 
sensible ways. If we can't be shown the certs in question (or much worse the CA 
didn't keep records) it's tough to be sure the risk is tolerable, we're back to 
taking the CA's word for it.
_______________________________________________
dev-security-policy mailing list
dev-security-policy@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security-policy