RE: WoSign has new roots?

2016-11-22 Thread Arkadiusz Ławniczak
Hello Lewis and all WoSign, as our Partner, is entitled to sell Asseco Data Systems (Certum) products through its own distribution network. While recently issued intermediate CAs certificates are dedicated to WoSign as our reseller, so that WoSign can sell certificates under its own brand, they

RE: WoSign has new roots?

2016-11-22 Thread Richard Wang
This is a common way for all CAs that issued many intermediate CAs for its resellers. Best Regards, Richard -Original Message- From: dev-security-policy [mailto:dev-security-policy-bounces+richard=wosign@lists.mozilla.org] On Behalf Of Ryan Sleevi Sent: Wednesday, November 23, 20

RE: WoSign has new roots?

2016-11-22 Thread Richard Wang
Hi all, This is the OEM certificate from Certum, Certum own and control everything with its own validation, you can check the test site: https://ovpretest.wosign.com that its CPS/CRL/OCSP/OID all belong to Certum. I don't think WoSign can't be a reseller of other CA. Thanks. Best Regards,

Re: Let's Encrypt Blocklist Incident, November 21 2016

2016-11-22 Thread Kathleen Wilson
On Tuesday, November 22, 2016 at 12:16:43 PM UTC-8, jo...@letsencrypt.org wrote: > Between 11:30am and 4pm Pacific on November 21, 2016, a problem with > the Let’s Encrypt issuance blocklist was identified, confirmed, and fixed. > > > The following certificates were found to have been mis-issued

Open BR Compliance Bugs

2016-11-22 Thread Kathleen Wilson
I have created a wiki page listing CA Bugs in Bugzilla: https://wiki.mozilla.org/CA/ca-bugs There are two sections: 1) Open Incident Related Bugs 2) Open BR Compliance Bugs The data is pulled directly from Bugzilla. I will greatly appreciate help from everyone in driving all of the BR Complian

Re: WoSign has new roots?

2016-11-22 Thread Ryan Sleevi
On Tue, Nov 22, 2016 at 3:30 PM, Patrick Figel wrote: > I'm a bit unclear on whether WoSign could be acting as a Registration > Authority > for certificates issued under that intermediate and what the auditing and > disclose requirements for that would be - maybe someone more familiar with > the

Re: WoSign has new roots?

2016-11-22 Thread Patrick Figel
On Tue, Nov 22, 2016 at 10:56 PM, Tobias Sachs wrote: > Am Dienstag, 22. November 2016 21:37:08 UTC+1 schrieb Lewis Resmond: >> Hello, >> >> I just noticed following announcement by WoSign: >> >> https://www.wosign.com/english/News/certificate_pre.htm >> >> If I understand correctly, they now have

Re: WoSign has new roots?

2016-11-22 Thread Tobias Sachs
Am Dienstag, 22. November 2016 21:37:08 UTC+1 schrieb Lewis Resmond: > Hello, > > I just noticed following announcement by WoSign: > > https://www.wosign.com/english/News/certificate_pre.htm > > If I understand correctly, they now have new root certificates which chain up > to Certum, which is

WoSign has new roots?

2016-11-22 Thread Lewis Resmond
Hello, I just noticed following announcement by WoSign: https://www.wosign.com/english/News/certificate_pre.htm If I understand correctly, they now have new root certificates which chain up to Certum, which is in the root storage. What does that mean in particular? Are the previously taken san

Let's Encrypt Blocklist Incident, November 21 2016

2016-11-22 Thread josh
Between 11:30am and 4pm Pacific on November 21, 2016, a problem with the Let’s Encrypt issuance blocklist was identified, confirmed, and fixed. The issue was initially identified by a Let’s Encrypt operations engineer during routine maintenance. A script is used to assemble a final blocklist co

Re: Guang Dong Certificate Authority (GDCA) root inclusion request

2016-11-22 Thread wangsn1206
Thanks for all suggestions upon our CP/CPS and base on the development of our business, we have revised and prepared a bilingual edition of CP/CPS, which have been submitted to our auditor to check the consistency of major contents between Chinese version and English version, and officially publ

Re: Technically Constrained Sub-CAs

2016-11-22 Thread Gervase Markham
On 21/11/16 19:01, Brian Smith wrote: > In another message in this thread, I suggested one way to mark intermediate > certificates as meeting the criteria of an name-constrained > externally-operated sub-CA that uses certificate policy OIDs. That proposed > mechanism also ensures externally-operate

Re: SHA-1 Phase-out

2016-11-22 Thread Gervase Markham
On 21/11/16 20:29, Myers, Kenneth (10421) wrote: > I've been trying to stay on top of the SHA-1 phase-out discussion but > lost track. Where did it leave off? I drafted a potential update to Mozilla's policy which was discussed here, and has now moved to the CAB Forum public list for further discu