The Korea GPKI MOI CA certificates are in the inclusion process. As I noted in the bug, I've added information on the reported misissuance and OCSP errors to the inclusion request and I've noted the concerns raised about the auditor in their CCADB record.
- Wayne On Thu, Apr 5, 2018 at 10:03 AM, hstsrequest--- via dev-security-policy < [email protected]> wrote: > Deloitte Anjin did the WebTrust audit for South Korea GPKI(Government > Public Key Infrastructure). > > they audited two organization "Ministry of the Interior" and "Ministry of > the Education" > buy they did not follow CA/B Forum BR.. > > they issued certificate without domain validaion. ex) www.testssl.com > they issued certificate to TLD domain(public suffix). ex) *.ac.kr which > is public suffix list. > > audit report of Deloitte Anjin say's "everythins is OK" for 2 years (2016, > 2017) > > https://bugs.chromium.org/p/chromium/issues/detail?id=823665 > > > GPKI(MOI) > > 2017 > https://cert.webtrust.org/ViewSeal?id=2183 > https://cert.webtrust.org/ViewSeal?id=2184 > > EPKI(MOE) > > 2017 > https://cert.webtrust.org/ViewSeal?id=2260 > https://cert.webtrust.org/ViewSeal?id=2259 > > GPKI(MOI) 2016 > https://cert.webtrust.org/ViewSeal?id=1923 > https://cert.webtrust.org/ViewSeal?id=1924 > > > related bug : https://bugzilla.mozilla.org/show_bug.cgi?id=1451235 > _______________________________________________ > dev-security-policy mailing list > [email protected] > https://lists.mozilla.org/listinfo/dev-security-policy > _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
