RE: Violation report - Comodo CA certificates revocation delays

2018-12-17 Thread Tim Hollebeek via dev-security-policy
I don't think we've commented on this before, but I'll note that sending an e-mail from the e-mail address listed as the contact address on a website is not one of the approved methods of showing ownership or control of a website as specified in section 3.2.2.4. The approved methods of validating

Re: Violation report - Comodo CA certificates revocation delays

2018-12-17 Thread please please via dev-security-policy
A lot of things changes in 3 months it seems. ?? The wording for the new "validation of domain authorization or control [...] should not be relied upon" condition seems open to interpretation, so I'm not sure if it really applies here. Wouldn't it fully cover the "no longer legally permitted"

Re: Violation report - Comodo CA certificates revocation delays

2018-12-17 Thread Wayne Thayer via dev-security-policy
On Sun, Dec 16, 2018 at 11:49 PM please please wrote: > I just noticed that Comodo CA has finally posted its incident report in > https://bugzilla.mozilla.org/show_bug.cgi?id=1492006 > > Comments: > - The report suggests that no BR violation occurred because I was not the > Subscriber to fulfill

Re: Violation report - Comodo CA certificates revocation delays

2018-12-17 Thread please please via dev-security-policy
I just noticed that Comodo CA has finally posted its incident report in https://bugzilla.mozilla.org/show_bug.cgi?id=1492006 Comments: - The report suggests that no BR violation occurred because I was not the Subscriber to fulfill the conditions in bullet point 1 of BR 4.9.1.1. However, I