Re: DigiCert ROCA fingerprint incident report

2017-11-08 Thread Rob Stradling via dev-security-policy
ote: I believe so – I asked that they all be logged, but I’ll need to double check whether it got done. From: Alex Gaynor [mailto:agay...@mozilla.com] Sent: Tuesday, November 7, 2017 11:23 AM To: Jeremy Rowley Cc: mozilla-dev-security-pol...@lists.mozilla.org Subject: Re: DigiCert ROCA fi

RE: DigiCert ROCA fingerprint incident report

2017-11-07 Thread Jeremy Rowley via dev-security-policy
olicy Sent: Tuesday, November 7, 2017 11:40 AM To: Kurt Roeckx Cc: mozilla-dev-security-pol...@lists.mozilla.org Subject: RE: DigiCert ROCA fingerprint incident report Yeah - still trying to get that info. I'll update this list right when I know what's been done. I'm not 100% sure at

RE: DigiCert ROCA fingerprint incident report

2017-11-07 Thread Jeremy Rowley via dev-security-policy
ssage- From: Kurt Roeckx [mailto:k...@roeckx.be] Sent: Tuesday, November 7, 2017 11:38 AM To: Jeremy Rowley Cc: mozilla-dev-security-pol...@lists.mozilla.org Subject: Re: DigiCert ROCA fingerprint incident report Hi, What I miss is what has been done to prevent new ones from being issued. Ku

Re: DigiCert ROCA fingerprint incident report

2017-11-07 Thread Kurt Roeckx via dev-security-policy
Hi, What I miss is what has been done to prevent new ones from being issued. Kurt On Tue, Nov 07, 2017 at 06:20:53PM +, Jeremy Rowley via dev-security-policy wrote: > Hey everyone, > > > > Here's the DigiCert incident report about the ROCA fingerprints. Note that > these were all issu

RE: DigiCert ROCA fingerprint incident report

2017-11-07 Thread Jeremy Rowley via dev-security-policy
fingerprint incident report Hi Jeremy, Have all these certificates been submitted to CT? Thanks! Alex On Tue, Nov 7, 2017 at 1:20 PM, Jeremy Rowley via dev-security-policy mailto:dev-security-policy@lists.mozilla.org> > wrote: Hey everyone, Here's the DigiCert incident repor

Re: DigiCert ROCA fingerprint incident report

2017-11-07 Thread Alex Gaynor via dev-security-policy
Hi Jeremy, Have all these certificates been submitted to CT? Thanks! Alex On Tue, Nov 7, 2017 at 1:20 PM, Jeremy Rowley via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > Hey everyone, > > > > Here's the DigiCert incident report about the ROCA fingerprints. Note that > th

DigiCert ROCA fingerprint incident report

2017-11-07 Thread Jeremy Rowley via dev-security-policy
Hey everyone, Here's the DigiCert incident report about the ROCA fingerprints. Note that these were all issued by Symantec (ie, before the transaction closed). We became aware of the issue when it was posted to the mailing list. However, at that time, the certs were not operated by DigiCer