Re: Clarification of disclosure - Only those Issuing or all?

2014-05-28 Thread Kathleen Wilson
On 5/22/14, 3:53 PM, Kathleen Wilson wrote: On 5/22/14, 1:18 PM, Kurt Roeckx wrote: On Thu, May 22, 2014 at 02:57:26PM -0500, Steve Roylance wrote: Hi Kathleen, The policy group responsible for control of our certificates and keys have a question for you concerning the disclosure requirement

Re: Question about disclosing subCA certs

2014-05-28 Thread Kathleen Wilson
I added item #4 to https://wiki.mozilla.org/CA:CertificatePolicyV2.1#Frequently_Asked_Questions -- 4. If an included trust anchor does not have the websites (SSL/TLS) trust bit enabled, can it be exempt from items #9 and #10 of Mozilla's CA Certificate Inclusion Policy? - A subordinate CA c

Re: Checking certificate requirements

2014-05-28 Thread Brian Smith
On Wed, May 28, 2014 at 4:42 PM, Ryan Sleevi < ryan-mozdevsecpol...@sleevi.com> wrote: > Whether it's version 1 or 3 has no effect on path building. If the policy > does require this, it's largely for cosmetic reasons than any strong > technical reasons. > > That said, cutting a new v3 root may in

Re: Checking certificate requirements

2014-05-28 Thread Ryan Sleevi
On Wed, May 28, 2014 3:19 pm, Kathleen Wilson wrote: > On 5/25/14, 9:53 AM, Kurt Roeckx wrote: > > On Tue, May 20, 2014 at 11:23:54AM -0700, Kathleen Wilson wrote: > >> Maybe we should re-visit the idea of a "wall of shame", and publicly > >> list > >> the CAs who are still issuing certificates wi

thread pointer for Firefox OS Gaia Email app and invalid certificates/certificate exceptions

2014-05-28 Thread Andrew Sutherland
In an attempt to address the cross-cutting https://bugzil.la/874346 on adding certificate exceptions initiated by the Firefox OS Gaia email app I've started a thread on dev.platform entitled "B2G, email, and SSL/TLS certificate exceptions for invalid certificates". If you're interested, please

Re: Checking certificate requirements

2014-05-28 Thread Kathleen Wilson
On 5/25/14, 9:53 AM, Kurt Roeckx wrote: On Tue, May 20, 2014 at 11:23:54AM -0700, Kathleen Wilson wrote: Maybe we should re-visit the idea of a "wall of shame", and publicly list the CAs who are still issuing certificates with the following problems. [...] * Certificate not version 3 I've on