RE: Certificates with reserved IP addresses

2017-08-15 Thread Ben Wilson via dev-security-policy
Gerv, Yes. We'll be revoking both of those. A date is yet to be determined. Ben Gerv wrote: TI Trust Technologies has two intermediate certificates in the CCADB - the one mentioned above: https://ccadb.my.salesforce.com/001o00cdd4t and this one, serial number 0727bfc4: https://ccadb.

Re: Certificates with reserved IP addresses

2017-08-15 Thread Gervase Markham via dev-security-policy
On 14/08/17 21:32, Ben Wilson wrote: > What steps DigiCert is taking to prevent these issues in the future?: > As a result of this and other recent issues, DigiCert is bringing > certificate issuance for TI Trust Technologies in-house. We will be > revoking CA certificate serial no. ‎07279ca7 issu

RE: Certificates with reserved IP addresses

2017-08-14 Thread Jeremy Rowley via dev-security-policy
icert@lists.mozilla.org] On Behalf Of Ryan Sleevi via dev-security-policy Sent: Saturday, August 12, 2017 8:56 PM To: Ben Wilson Cc: Jonathan Rudenberg ; mozilla-dev-security-pol...@lists.mozilla.org Subject: Re: Certificates with reserved IP addresses Do you have an estimate on when you can provide an explanati

RE: Certificates with reserved IP addresses

2017-08-14 Thread Ben Wilson via dev-security-policy
yours, Ben Ben Wilson, JD, CISA, CISSP VP Compliance +1 801 701 9678 From: Ryan Sleevi [mailto:r...@sleevi.com] Sent: Saturday, August 12, 2017 8:56 PM To: Ben Wilson Cc: Jonathan Rudenberg ; mozilla-dev-security-pol...@lists.mozilla.org Subject: Re: Certificates with reser

RE: Certificates with reserved IP addresses

2017-08-12 Thread Ben Wilson via dev-security-policy
We’ll look into these on Monday and get back to you. From: Ryan Sleevi [mailto:r...@sleevi.com] Sent: Saturday, August 12, 2017 8:56 PM To: Ben Wilson Cc: Jonathan Rudenberg ; mozilla-dev-security-pol...@lists.mozilla.org Subject: Re: Certificates with reserved IP addresses Do you

Re: Certificates with reserved IP addresses

2017-08-12 Thread Ryan Sleevi via dev-security-policy
Do you have an estimate on when you can provide an explanation to the community about how/why this happened, how many certificates it affected, and what steps DigiCert is taking to prevent these issues in the future? Do you have details about why DigiCert failed to detect these, and what steps Digi

RE: Certificates with reserved IP addresses

2017-08-12 Thread Jeremy Rowley via dev-security-policy
The CTJ one was issued in 2013 and is a five year cert (which was also prohibited under the BRs at that time_. It should have been revoked much earlier, of course. -Original Message- From: dev-security-policy [mailto:dev-security-policy-bounces+jeremy.rowley=digicert@lists.mozilla.

Re: Certificates with reserved IP addresses

2017-08-12 Thread Peter Bowen via dev-security-policy
Congratulations on finding something not caught by certlint. It turns out that cabtlint does zero checks for reserved IPs. Something else for my TODO list. On Sat, Aug 12, 2017 at 6:52 PM, Jonathan Rudenberg via dev-security-policy wrote: > Baseline Requirements section 7.1.4.2.1 prohibits ipAd

RE: Certificates with reserved IP addresses

2017-08-12 Thread Ben Wilson via dev-security-policy
Thanks. We've sent an email to the operators of the first two CAs (TI Trust Technologies and Cybertrust Japan) that they need to revoke those certificates. Thanks again, Ben -Original Message- From: dev-security-policy [mailto:dev-security-policy-bounces+ben=digicert@lists.mozilla.o