These concrete suggestions of alternative text are very helpful. I have updated the bright green text in the draft policy document <https://docs.google.com/document/d/1ESakR4MiwyENyuLefyH2wG8rYbtnmG1xeSYvDNpS-EI/edit?usp=sharing> per your recommendations: === The scope of revocation depends on whether the certificate subscriber has proven possession of the private key of the certificate. - If anyone requesting revocation has previously demonstrated or can currently demonstrate possession of the private key of the certificate, then the CA MUST revoke all instances of that key across all subscribers. - If the certificate subscriber requests that the CA revoke the certificate for keyCompromise, and has not previously demonstrated and cannot currently demonstrate possession of the associated private key of that certificate, the CA SHOULD revoke all certificates associated with that subscriber that contain that public key. The CA SHOULD NOT assume that it has evidence of private key compromise for the purposes of revoking the certificates of other subscribers or blocking issuance of future certificates with that key. ===
I will continue to appreciate recommendations on how to improve the draft policy <https://docs.google.com/document/d/1ESakR4MiwyENyuLefyH2wG8rYbtnmG1xeSYvDNpS-EI/edit?usp=sharing> . Thanks, Kathleen PS: I would like to especially thank Ryan Sleevi for his help here -- Another CA had brought the initial concern to my attention and I asked Ryan to help explain it here in MDSP, and thankfully he has continued to help with this discussion. Thanks, Ryan! -- You received this message because you are subscribed to the Google Groups "[email protected]" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/1ea9277d-97c7-45aa-8d58-058b8fee1f77n%40mozilla.org.
