dev-security-policy@mozilla.org

1–30 of 158

Welcome to the dev-security-policy group in which we discuss security-related policies, governance, and related topics; including discussion of Mozilla’s Root Store Policy and the NSS root certificate store.

Mailing List: dev-security-policy@mozilla.org
Web: https://groups.google.com/a/mozilla.org/g/dev-security-policy
Subscribe by sending email to: dev-security-policy+subscribe@mozilla.org
Unsubscribe by sending email to: dev-security-policy+unsubscribe@mozilla.org
Previous archives: https://groups.google.com/g/mozilla.dev.security.policy
RSS feed: https://www.mail-archive.com/dev-security-policy@mozilla.org/maillist.xml

0 selected

Kathleen Wilson17

Oct 4

Audit Reminder Email Summary - Intermediate Certificates

-------- Forwarded Message -------- Subject: Summary of October 2022 Outdated Audit Statements for

unread,

Audit Reminder Email Summary - Intermediate Certificates

-------- Forwarded Message -------- Subject: Summary of October 2022 Outdated Audit Statements for

Oct 4

Kathleen Wilson

Sep 30

Providing Full CRLs for root certificates in CCADB

All, To provide the "Full CRL Issued By This CA" for root certificate records, you will

unread,

Providing Full CRLs for root certificates in CCADB

All, To provide the "Full CRL Issued By This CA" for root certificate records, you will

Sep 30

Rob Stradling, … Ben Wilson7

Sep 30

Re: CRL Issuance Frequency for non-published CRLs

Thanks Clint! To help CAs and any other interested parties track compliance with the various existing

unread,

Re: CRL Issuance Frequency for non-published CRLs

Thanks Clint! To help CAs and any other interested parties track compliance with the various existing

Sep 30

Michel Le Bihan, … Matthias van de Meent13

Sep 29

Protection against BGP hijacking

Recently there was another case of BGP hijacking where an attacker acquired a TLS certificate: https:

unread,

Protection against BGP hijacking

Recently there was another case of BGP hijacking where an attacker acquired a TLS certificate: https:

Sep 29

Andrew Ayer, Daniel Zens2

Sep 27

Invalid URLs in "Full CRL Issued By This CA" field

Hi Andrew, Thank you, I have fixed the missing http:// for: lva.at/files/lva_2016.crl Best Daniel

unread,

Invalid URLs in "Full CRL Issued By This CA" field

Hi Andrew, Thank you, I have fixed the missing http:// for: lva.at/files/lva_2016.crl Best Daniel

Sep 27

Rob Stradling, … Ryan Hurst4

Sep 26

Add another field to AllCertificateRecordsCSVFormat

Kathleen, I believe at least part of the problem Andrew mentions is because of Salesforce or some

unread,

Add another field to AllCertificateRecordsCSVFormat

Kathleen, I believe at least part of the problem Andrew mentions is because of Salesforce or some

Sep 26

Ben Wilson, … Jeffrey Walton22

Sep 25

Proposed Updates to MRSP to Address Root CA Life Cycles

On Mon, Sep 19, 2022 at 1:44 PM Ben Wilson <bwilson@mozilla.com> wrote: Here is another option

unread,

Proposed Updates to MRSP to Address Root CA Life Cycles

On Mon, Sep 19, 2022 at 1:44 PM Ben Wilson <bwilson@mozilla.com> wrote: Here is another option

Sep 25

Rob Stradling, Doug Beattie3

Sep 23

Tracking CRL Disclosure Compliance

Thanks Doug. > A number of Roots were listed. Since this is for ICAs, should we exclude those?

unread,

Tracking CRL Disclosure Compliance

Thanks Doug. > A number of Roots were listed. Since this is for ICAs, should we exclude those?

Sep 23

Kathleen Wilson, … Matthias van de Meent22

Sep 20

Audit Reminder Email Summary - Root Certificates

-------- Forwarded Message -------- Subject: Summary of September 2022 Audit Reminder Emails Date:

unread,

Audit Reminder Email Summary - Root Certificates

-------- Forwarded Message -------- Subject: Summary of September 2022 Audit Reminder Emails Date:

Sep 20

Kathleen Wilson, … Ben Wilson4

Sep 15

CCADB Update: "Add/Update Root Request” Case type

All, We have completed the update, CCADB is no longer read-only, and the message on the CCADB home

unread,

CCADB Update: "Add/Update Root Request” Case type

All, We have completed the update, CCADB is no longer read-only, and the message on the CCADB home

Sep 15

Hanno Böck, … Rob Stradling7

Sep 13

Debian Weak Keys and ECDSA

> What I do in badkeys is that I don't blocklist keys, but values. > Modulus for RSA, x

unread,

Debian Weak Keys and ECDSA

> What I do in badkeys is that I don't blocklist keys, but values. > Modulus for RSA, x

Sep 13

Michel Le Bihan, … Daniel Veditz5

Sep 9

Certificates with Cloudflare, Inc. in subject

On Fri, Sep 9, 2022 at 3:12 AM Michel Le Bihan <michel.lebihan2000@gmail.com> wrote: OV and EV

unread,

Certificates with Cloudflare, Inc. in subject

On Fri, Sep 9, 2022 at 3:12 AM Michel Le Bihan <michel.lebihan2000@gmail.com> wrote: OV and EV

Sep 9

Chris Clements, … Man Ho5

Sep 7

CA Compliance Self-Assessment Update

Hi Man, We are working with the CCADB Steering Committee to enable functionality for including self-

unread,

CA Compliance Self-Assessment Update

Hi Man, We are working with the CCADB Steering Committee to enable functionality for including self-

Sep 7

Jeffrey Walton, … Aaron Gable10

Sep 6

Malformed Trustwave certificates in Mozilla's ca cert collection

Just to close the loop on this: Christopher Henderson has done some great work to get two new checks

unread,

Malformed Trustwave certificates in Mozilla's ca cert collection

Just to close the loop on this: Christopher Henderson has done some great work to get two new checks

Sep 6

Aaron Gable, … Christophe Bonjean8

Sep 1

CRL Issuance Frequency for non-published CRLs

Hi Ben, The proposed phrasing sounds like a more flexible approach of CRL publishing, which seems to

unread,

CRL Issuance Frequency for non-published CRLs

Hi Ben, The proposed phrasing sounds like a more flexible approach of CRL publishing, which seems to

Sep 1

LB, … Ben Wilson10

Aug 31

Entrust, ransomware, can they be trusted?

All, I have opened an issue in Github to begin work on drafting reporting requirements for CA

unread,

Entrust, ransomware, can they be trusted?

All, I have opened an issue in Github to begin work on drafting reporting requirements for CA

Aug 31

John Han, … Ryan Hurst7

Aug 30

PreCertificate in CT log but related Certificate not found.

Neither Chrome nor Safari requires the publication of final certificates. They do display

unread,

PreCertificate in CT log but related Certificate not found.

Neither Chrome nor Safari requires the publication of final certificates. They do display

Aug 30

Amir Omidi, … Ryan Hurst7

Aug 30

Proposing a new ACME challenge type: DNS-ACCOUNT-01

Clients do not have this removal behavior today, and there is still the issue of multiple providers

unread,

Proposing a new ACME challenge type: DNS-ACCOUNT-01

Clients do not have this removal behavior today, and there is still the issue of multiple providers

Aug 30

Ryan Dickson, … Buschart, Rufus4

Aug 30

Revocation checking for EV server certificates in Chrome

Hi Ryan! Thank you for your email explaining the way how Google works with sharded CRLs. I only did

unread,

Revocation checking for EV server certificates in Chrome

Hi Ryan! Thank you for your email explaining the way how Google works with sharded CRLs. I only did

Aug 30

Aug 18

Fwd: Preparing for the Migration to Post-Quantum Cryptography

For those interested. ---------- Forwarded message --------- From: NIST Cybersecurity and Privacy

unread,

Fwd: Preparing for the Migration to Post-Quantum Cryptography

For those interested. ---------- Forwarded message --------- From: NIST Cybersecurity and Privacy

Aug 18

Aug 16

Proposed Baseline Requirements for the Issuance of S/MIME Certificates

All, Our normal process when working with major proposals of the CA/B Forum is to circulate them to

unread,

Proposed Baseline Requirements for the Issuance of S/MIME Certificates

All, Our normal process when working with major proposals of the CA/B Forum is to circulate them to

Aug 16

Aug 15

Fwd: Public Discussion of DigitalSign's Global Roots (email trust bit only)

All, On July 21, 2022, we began a three-week public discussion period[1] on the request from

unread,

Fwd: Public Discussion of DigitalSign's Global Roots (email trust bit only)

All, On July 21, 2022, we began a three-week public discussion period[1] on the request from

Aug 15

Aug 11

CCADB Down Temporarily for Maintenance

All, The CCADB has now been updated to introduce a new workflow and UI for Audit Cases. New

unread,

CCADB Down Temporarily for Maintenance

All, The CCADB has now been updated to introduce a new workflow and UI for Audit Cases. New

Aug 11

Tavis Ormandy, … Jeremy Rowley11

Aug 10

BR revocation question

On Wed, Aug 10, 2022 at 06:57:32PM +0000, Jeremy Rowley wrote: > The general instruction I got was

unread,

BR revocation question

On Wed, Aug 10, 2022 at 06:57:32PM +0000, Jeremy Rowley wrote: > The general instruction I got was

Aug 10

Aug 2

Public Discussion of SECOM Trust Systems' Inclusion Request

All, On July 5, 2022, we began a three-week public discussion[1] on the request from SECOM for

unread,

Public Discussion of SECOM Trust Systems' Inclusion Request

All, On July 5, 2022, we began a three-week public discussion[1] on the request from SECOM for

Aug 2

Jul 27

New Cross-Certificate of Hongkong Post CA for Extending Android Device Compatibility

Hi Everyone, FYI, we created the cross-certificate yesterday, 27 July 2022. And I've registered

unread,

New Cross-Certificate of Hongkong Post CA for Extending Android Device Compatibility

Hi Everyone, FYI, we created the cross-certificate yesterday, 27 July 2022. And I've registered

Jul 27

Kathleen Wilson

Jul 19

CCADB: Updating Audit Case Workflow

All, We are updating the Audit Cases in the CCADB to have the same workflow as the Information Update

unread,

CCADB: Updating Audit Case Workflow

All, We are updating the Audit Cases in the CCADB to have the same workflow as the Information Update

Jul 19

Kathleen Wilson

Jul 19

CCADB: Added Instructions for New User and Password Reset

All, This is just FYI that I updated the "For CAs" tab of www.ccadb.org to add New User

unread,

CCADB: Added Instructions for New User and Password Reset

All, This is just FYI that I updated the "For CAs" tab of www.ccadb.org to add New User

Jul 19

Kathleen Wilson, … Phillip Hallam-Baker16

Jul 16

Mozilla Campaign: securityriskahead.eu

On Sat, Jul 16, 2022 at 4:06 AM Watson Ladd <watsonbladd@gmail.com> wrote: There's also the

unread,

Mozilla Campaign: securityriskahead.eu

On Sat, Jul 16, 2022 at 4:06 AM Watson Ladd <watsonbladd@gmail.com> wrote: There's also the

Jul 16

Jul 13

WebPKI, Certificate 'Resellers' versus Enterprise RA versus RA/Delegated Third Party

I am researching WebPKI, looking at the practical offers of Certificate Authorities and parties who

unread,

WebPKI, Certificate 'Resellers' versus Enterprise RA versus RA/Delegated Third Party

I am researching WebPKI, looking at the practical offers of Certificate Authorities and parties who

Jul 13

Search

Clear search

Close search

Google apps

Main menu