RE: [EXT] Re: DigiCert-Symantec Announcement

2017-09-01 Thread Steve Medin via dev-security-policy
We are not making any changes at this time. > -Original Message- > From: dev-security-policy [mailto:dev-security-policy- > bounces+steve_medin=symantec@lists.mozilla.org] On Behalf Of > Adrian R. via dev-security-policy > Sent: Friday, September 01, 2017 4:09 AM > To:

Re: O=U.S. Government for non-USG entity (IdenTrust)

2017-09-01 Thread identrust--- via dev-security-policy
On Thursday, August 31, 2017 at 11:31:48 PM UTC-4, Eric Mill wrote: > Thank you for the continued updates, and for relaying the deadline by which > these will be revoked. > > On Thu, Aug 31, 2017 at 9:35 PM, identrust--- via dev-security-policy < > dev-security-policy@lists.mozilla.org> wrote: >

Re: Idea for a stricter name constraint interpretation

2017-09-01 Thread Ryan Sleevi via dev-security-policy
On Fri, Sep 1, 2017 at 2:07 AM, Jakob Bohm via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > RFC2818 postdates real world https by several years. The original de > facto standard by Netscape/Mozilla used the commonName semantics, which > survived for more than a decade in

Re: Violations of Baseline Requirements 4.9.10

2017-09-01 Thread Policy Authority PKIoverheid via dev-security-policy
> Government of The Netherlands, PKIoverheid (Logius) > > DN: C=NL, O=KPN Corporate Market BV, CN=KPN Corporate Market CSP > Organisatie CA - G2 > Example cert: > https://crt.sh/?q=f821a600af00d2fa23f569e00fdf2379bc182920205a6b9b0276733cb2857c15 > OCSP URI: http://ocsp2.managedpki.com Dear

Re: Violations of Baseline Requirements 4.9.10

2017-09-01 Thread Policy Authority PKIoverheid via dev-security-policy
> Government of The Netherlands, PKIoverheid (Logius) > DN: C=NL, O=KPN Corporate Market BV, CN=KPN Corporate Market CSP > Organisatie CA - G2 > Example cert: > https://crt.sh/?q=f821a600af00d2fa23f569e00fdf2379bc182920205a6b9b0276733cb2857c15 > OCSP URI: http://ocsp2.managedpki.com Dear

Re: Per-intermediate CAA/problem reporting info

2017-09-01 Thread Gervase Markham via dev-security-policy
On 28/08/17 18:40, Andrew Ayer wrote: > However, externally-operated sub-CAs generally have their own CAA > identifiers and problem reporting information, and this information > is not currently collected. Would it be possible to collect this > information on a per-intermediate basis and to

Re: Remove old WoSign root certs from NSS

2017-09-01 Thread Gervase Markham via dev-security-policy
On 30/08/17 18:50, Kathleen Wilson wrote: > https://blog.mozilla.org/security/2017/08/30/removing-disabled-wosign-startcom-certificates-firefox-58/ > > I will look into getting this translated and published in China. Here are the links to the post in Chinese, kindly supplied by our colleagues:

Re: Adding a subCA to OneCRL when email-signing users may be impacted

2017-09-01 Thread Gervase Markham via dev-security-policy
On 01/09/17 04:47, Víctor wrote: > But I find an issue here. The root has both websites and email trust > bits. The subCA cert is not constrained. The representative of the CA > want to add the subCA to OneCRL because this subCA doesn't issue TLS > certificates. OneCRL and the CA program acts on

RE: Violations of Baseline Requirements 4.9.10

2017-09-01 Thread 加毛 寿 via dev-security-policy
※個人情報保護のため、宛先を非表示(BCC)にて送信しています。 - Paul-san, Thank you for the notice. We are going to investigate on this matter. Best regards, Hisashi Kamo Secom Trust Systems > -Original Message- > From: dev-security-policy >

Adding a subCA to OneCRL when email-signing users may be impacted

2017-09-01 Thread Víctor via dev-security-policy
Hello everyone, This is the first time I am writing here. I've been reading for a time (part) of this list and the Bugzilla section of the CA Program. I hope I can cooperate. I am specially interested on the technical aspects and legal implications that electronic certificates have on the EU,

Re: DigiCert-Symantec Announcement

2017-09-01 Thread Adrian R. via dev-security-policy
a small question: what's going to happen with https://www.freessl.com/ ? under Symantec's leadership it was intended for the site to become a free alternative to StartCom and LetsEncrypt, but it was not quite opened for issuance except for non-profits. Now with the transition of the CA

Re: Idea for a stricter name constraint interpretation

2017-09-01 Thread Jakob Bohm via dev-security-policy
On 01/09/2017 02:14, Ryan Sleevi wrote: On Thu, Aug 31, 2017 at 5:21 PM, Jakob Bohm via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: On 31/08/2017 22:26, Ryan Sleevi wrote: Agreed. But in general, in order to maintain interoperability, there's a process for building