Re: Francisco Partners acquires Comodo certificate authority business

2017-11-09 Thread Peter Bachman via dev-security-policy
On Tuesday, October 31, 2017 at 9:22:09 AM UTC-4, Kyle Hamilton wrote: > http://www.eweek.com/security/francisco-partners-acquires-comodo-s-certificate-authority-business I did a little spot check. So yes they hired a person who was involved with Entrust, so that is a plus. The website says it

Re: Acquisition policy (was: Francisco Partners acquires Comodo certificate authority business)

2017-11-09 Thread Peter Kurrasch via dev-security-policy
There's always a risk that a CA owner will create a security nightmare when we aren't looking, probationary period or not. In theory regular audits help to prevent it, but even in cases where they don't, people

Re: Discrepancy in Included CAs and Included CA Certificates List

2017-11-09 Thread Kathleen Wilson via dev-security-policy
On 11/9/17 5:58 AM, cbonn...@trustwave.com wrote: Hello all, I was cross-referencing data contained in the "Included CAs" spreadsheet (https://wiki.mozilla.org/CA/Included_CAs) and the "Included CA Certificates" spreadsheet (https://wiki.mozilla.org/CA/Included_Certificates) and discovered

Discrepancy in Included CAs and Included CA Certificates List

2017-11-09 Thread cbonnell--- via dev-security-policy
Hello all, I was cross-referencing data contained in the "Included CAs" spreadsheet (https://wiki.mozilla.org/CA/Included_CAs) and the "Included CA Certificates" spreadsheet (https://wiki.mozilla.org/CA/Included_Certificates) and discovered that CNNIC is listed in the "Included CAs" spreadsheet

Re: Incident report - ROCA fingerprints in certificates issued by Comodo CA (was Re: RSA key generation vulnerability in Infineon firmware)

2017-11-09 Thread Rob Stradling via dev-security-policy
On 09/11/17 13:09, Rob Stradling via dev-security-policy wrote: On 06/11/17 22:26, Rob Stradling via dev-security-policy wrote: On Monday 6th November, we scanned the certificates that we'd issued between 20th October and 5th November.  8 further server authentication certificates were found,

Re: Incident report - ROCA fingerprints in certificates issued by Comodo CA (was Re: RSA key generation vulnerability in Infineon firmware)

2017-11-09 Thread Rob Stradling via dev-security-policy
On 06/11/17 22:26, Rob Stradling via dev-security-policy wrote: On Monday 6th November, we scanned the certificates that we'd issued between 20th October and 5th November.  8 further server authentication certificates were found, all for subdomains of the same registered domain.  We will get