Re: PROCERT issues

2017-10-03 Thread Ryan Sleevi via dev-security-policy
Hi Kathleen, With respect to providing a list - is there any requirement to ensure Mozilla accepts that as a reasonable remediation? For example, would "We plan to not do the same in the future" be an acceptable remediation plan? As currently worded, it would seem to meet the letter of this

Issuing and using SHA-1 OCSP signing certificates

2017-10-03 Thread Doug Beattie via dev-security-policy
Hello Gerv, The BRs are clear on the use of SHA-1, but I have a question about the Mozilla policy and how it relates to the use of SHA-1 OCSP signing certificates. In December 2016 the Mozilla policy 2.3 was published and it didn't address the use of SHA-1 on OCSP signing certificates (see