Re: Anomalous Certificate Issuances based on historic CAA records

2017-11-30 Thread Wayne Thayer via dev-security-policy
What problem(s) are you trying to solve? - Subscribers already (or soon will) have CT logs and monitors available to detect mis-issued certs. They don't need CAA Transparency. - This thread started as a discussion over possible mis-issuance that was determined to be false positives. As has been

Re: Swiss Government root inclusion request

2017-11-28 Thread Wayne Thayer via dev-security-policy
On Thursday, November 23, 2017 at 4:03:27 AM UTC-7, michael.vonn...@bit.admin.ch wrote: > Hi Matt > > Thank you for your statement. > > Let me try to clarify: > > In 3.2.2.4 we specify the Authorization by Domain Name Registrant as follows: > > 3.2.2.4 Authorization by Domain Name Registrant

Re: Acquisition policy (was: Francisco Partners acquires Comodo certificate authority business)

2017-11-10 Thread Wayne Thayer via dev-security-policy
On Thu, Nov 9, 2017 at 1:25 PM, Peter Kurrasch via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > There's always a risk that a CA owner will create a security nightmare > when we aren't looking, probationary period or not. In theory regular > audits help to prevent it, but

RE: GoDaddy Misissuance Action Items

2017-02-13 Thread Wayne Thayer via dev-security-policy
> -Original Message- > From: dev-security-policy [mailto:dev-security-policy- > bounces+wthayer=godaddy@lists.mozilla.org] On Behalf Of Gervase > Markham via dev-security-policy > Here is our proposed remediation plan for GoDaddy. > > 1) As with all CAs, update all their domain

<    2   3   4   5   6   7