Re: StartCom inclusion request: next steps

2017-11-02 Thread Gervase Markham via dev-security-policy
Dear Inigo, On 14/09/17 09:49, Gervase Markham wrote: > The Mozilla CA Certificates team has been considering what the > appropriate next steps are for the inclusion request from the CA > "StartCom".[0] As readers will know, this CA has previously been removed > from trust[1], and so a

Re: StartCom inclusion request: next steps

2017-09-18 Thread James Burton via dev-security-policy
On Monday, September 18, 2017 at 11:38:57 AM UTC+1, Inigo Barreira wrote: > > > > I want to give you some words from one of the "community side" (this is a > > personal opinion and may vary from other opinions inside the community). > > > > Trust is not something that you get, it is something

RE: StartCom inclusion request: next steps

2017-09-18 Thread Inigo Barreira via dev-security-policy
> > I want to give you some words from one of the "community side" (this is a > personal opinion and may vary from other opinions inside the community). > > Trust is not something that you get, it is something that you earn. True > StartCom was distrusted because of serious issues with their

Re: StartCom inclusion request: next steps

2017-09-16 Thread mw--- via dev-security-policy
I want to give you some words from one of the "community side" (this is a personal opinion and may vary from other opinions inside the community). Trust is not something that you get, it is something that you earn. StartCom was distrusted because of serious issues with their old PKI and now

RE: StartCom inclusion request: next steps

2017-09-15 Thread Inigo Barreira via dev-security-policy
> > Yes, you´re right, that was on the table and also suggested by > > Mozilla, but the issue was that people from 360 are used to code in > > PHP and the old one was in Java and some other for which they are not > > so familiar and then was decided to re-write all the code in PHP > > trying to

RE: StartCom inclusion request: next steps

2017-09-15 Thread Inigo Barreira via dev-security-policy
tartcomca@lists.mozilla.org] On Behalf Of Percy via dev- > security-policy > Sent: jueves, 14 de septiembre de 2017 22:13 > To: mozilla-dev-security-pol...@lists.mozilla.org > Subject: Re: StartCom inclusion request: next steps > > "Conclusion: StartCom's atte

Re: StartCom inclusion request: next steps

2017-09-14 Thread Percy via dev-security-policy
"Conclusion: StartCom's attempt to restart the CA was rushed." "It was a very hard task in very few time but the people at 360 tried everything to get it done by that date, end of december 2016, and yes, we reached the date but with many failures" May I ask why StartCom choose to rush

Re: StartCom inclusion request: next steps

2017-09-14 Thread Jonathan Rudenberg via dev-security-policy
> On Sep 14, 2017, at 04:49, Gervase Markham via dev-security-policy > wrote: > > We should add the existing Certnomis cross-signs to OneCRL to revoke > all the existing certificates. As of 10th August (now a month ago) > StartCom said they have 5