On 24/01/18 00:47, Wayne Thayer wrote: > more frequently when requirements change. I propose that we require CAs to > update their CPS to comply with version 2.5 of the Mozilla root store > policy no later than 15-April 2018.
I think we should have a more general stipulation that Mozilla does not consider it reasonable to take more than N months to make an update to a CPS, with N being a number like 3 or 2. Now, a particular change my require code changes as well, and the CPS may only be updated when those are made, and that might take longer - that's fine. But if the requirement is e.g. "add some extra contact information", that's not fine. CAs should not be in the habit of having processes where their CPSes are only updated yearly. Gerv _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
