On Wednesday, 4 October 2017 13:34:17 UTC+1, Adriano Santoni wrote: > Nick, > > I think I have addressed this in my reply to Rob Stradling a few minutes > ago. > > In short: no, the "temporary unconstrained subCA" does never exist as a > signed document, only the final (constrained) subCA is signed.
Thank you Adriano, I agree your reply covers that. I still don't think I understand how "post-processing" came to be a necessary element of this process but since your planned remediation eliminates this anyway and we've established that there's never a signed unconstrained subCA even momentarily I don't think we need to dig into this any deeper, thank you for taking the time to reply. _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
