Re: DRAFT - BR Self Assessments

2017-04-24 Thread Kathleen Wilson via dev-security-policy
On Saturday, April 22, 2017 at 5:25:35 AM UTC-7, wangs...@gmail.com wrote: > We have a question about completing the BR self assessment,  > is it necessary that all the BRs requirements appear in  > relevant sections of the CP/CPS?  It is OK if the information is in different sections in the

Re: DRAFT - BR Self Assessments

2017-04-22 Thread wangsn1206--- via dev-security-policy
在 2017年4月4日星期二 UTC+8上午1:47:34，Kathleen Wilson写道： > I updated https://wiki.mozilla.org/CA:BRs-Self-Assessment to add a section > called 'Annual BR Self Assessment', which states: > "CAs with included root certificates that have the Websites trust bit set > must do an annual self-assessment of

Re: DRAFT - BR Self Assessments

2017-04-03 Thread Kathleen Wilson via dev-security-policy
I updated https://wiki.mozilla.org/CA:BRs-Self-Assessment to add a section called 'Annual BR Self Assessment', which states: "CAs with included root certificates that have the Websites trust bit set must do an annual self-assessment of their compliance with the BRs, and must update their CP

Re: DRAFT - BR Self Assessments

2017-03-29 Thread Kathleen Wilson via dev-security-policy
On Wednesday, March 29, 2017 at 2:00:05 PM UTC-7, Jeremy Rowley wrote: > ... > An extension on this could be to have CAs annually file an updated mapping > with their WebTrust audit. That way it's a reminder that the CA needs to > notify Mozilla of changes in their process and keeps the CAs

RE: DRAFT - BR Self Assessments

2017-03-29 Thread Jeremy Rowley via dev-security-policy
Hi Kathleen, This is a good idea, and I like the phased-in approach. The mapping exercise is similar to how other communities evaluate inclusion requests and makes it more apparent how the CA is complying with the various Mozilla requirements. An extension on this could be to have CAs annually