dev-security-policy@mozilla.org

1–30 of 51

Welcome to the dev-security-policy group in which we discuss security-related policies, governance, and related topics; including discussion of Mozilla’s Root Store Policy and the NSS root certificate store.

Mailing List: dev-security-policy@mozilla.org
Web: https://groups.google.com/a/mozilla.org/g/dev-security-policy
Subscribe by sending email to: dev-security-policy+subscribe@mozilla.org
Unsubscribe by sending email to: dev-security-policy+unsubscribe@mozilla.org
Previous archives: https://groups.google.com/g/mozilla.dev.security.policy
RSS feed: https://www.mail-archive.com/dev-security-policy@mozilla.org/maillist.xml

0 selected

2:25 PM

BR Self Assessment renamed to Compliance Self Assessment

All, I have updated the BR self-assessment template and renamed it to "Compliance Self

unread,

BR Self Assessment renamed to Compliance Self Assessment

All, I have updated the BR self-assessment template and renamed it to "Compliance Self

2:25 PM

Sep 20

Public Discussion of ISRG/Let's Encrypt's Inclusion Request

A root inclusion request has been submitted by Internet Security Research Group (Let's Encrypt).

unread,

Public Discussion of ISRG/Let's Encrypt's Inclusion Request

A root inclusion request has been submitted by Internet Security Research Group (Let's Encrypt).

Sep 20

Ben Wilson, … Li-Chun CHEN14

Sep 18

Public Discussion of Chunghwa Telecom's Root Inclusion Request

On August 3, 2021, we began a three-week public discussion[1] on a request by Chunghwa Telecom (

unread,

Public Discussion of Chunghwa Telecom's Root Inclusion Request

On August 3, 2021, we began a three-week public discussion[1] on a request by Chunghwa Telecom (

Sep 18

Ben Wilson, … yutian zheng23

Sep 18

Public Discussion re: Inclusion of the iTrusChina Root CAs

Hi Ben, We have revised a new version of CPS based on your comments and are going through the

unread,

Public Discussion re: Inclusion of the iTrusChina Root CAs

Hi Ben, We have revised a new version of CPS based on your comments and are going through the

Sep 18

Ben Wilson, … Brett L9

Sep 17

Public Discussion of Google Trust Services' Request to Replace Root CA Certificates

Hi Andrew, Thank you for your question and for asking for clarification. We have provided an update

unread,

Public Discussion of Google Trust Services' Request to Replace Root CA Certificates

Hi Andrew, Thank you for your question and for asking for clarification. We have provided an update

Sep 17

Sep 17

Accountability and best practices for CPS and code and/or process alignment

Hi MDSP community, There have been a number of past issues where actual practices followed by CAs

unread,

Accountability and best practices for CPS and code and/or process alignment

Hi MDSP community, There have been a number of past issues where actual practices followed by CAs

Sep 17

Kathleen Wilson5

Sep 7

Audit Reminder Email Summary - Intermediate Certificates

-------- Forwarded Message -------- Subject: Summary of September 2021 Outdated Audit Statements for

unread,

Audit Reminder Email Summary - Intermediate Certificates

-------- Forwarded Message -------- Subject: Summary of September 2021 Outdated Audit Statements for

Sep 7

Jaime Hablutzel

Sep 7

Why isn't the keyAgreement KU bit explicitly forbidden in ECDSA TLS certificates?

Hi, I'm seeing that the keyAgreement KU bit is not explicitly forbidden for ECDSA TLS

unread,

Why isn't the keyAgreement KU bit explicitly forbidden in ECDSA TLS certificates?

Hi, I'm seeing that the keyAgreement KU bit is not explicitly forbidden for ECDSA TLS

Sep 7

Ben Wilson, … Syrine Tlili22

Aug 24

Public Discussion re: Inclusion of the TunTrust Root CA

On April 7, 2021, we began public discussion[1] on the TunTrust root CA inclusion request[2] (Step 4

unread,

Public Discussion re: Inclusion of the TunTrust Root CA

On April 7, 2021, we began public discussion[1] on the TunTrust root CA inclusion request[2] (Step 4

Aug 24

Matthias van de Meent, … Ryan Sleevi3

Aug 23

DNS authorization delegation through non-ADN delegated records

Hi Matthias, This is permitted. It is not permitted to point the target of the CNAME to the CA, but

unread,

DNS authorization delegation through non-ADN delegated records

Hi Matthias, This is permitted. It is not permitted to point the target of the CNAME to the CA, but

Aug 23

Aug 19

Policy 2.8: Candidate Issues to Address in MRSP v. 2.8

All, Below are listed the Mozilla Root Store Policy (MRSP) issues currently slated to be addressed in

unread,

Policy 2.8: Candidate Issues to Address in MRSP v. 2.8

All, Below are listed the Mozilla Root Store Policy (MRSP) issues currently slated to be addressed in

Aug 19

Kathleen Wilson, … Matthias van de Meent9

Aug 17

Audit Reminder Email Summary - Root Certificates

-------- Forwarded Message -------- Subject: Summary of August 2021 Audit Reminder Emails Date: Tue,

unread,

Audit Reminder Email Summary - Root Certificates

-------- Forwarded Message -------- Subject: Summary of August 2021 Audit Reminder Emails Date: Tue,

Aug 17

Kathleen Wilson, … Clint Wilson11

Aug 16

CCADB Update: New field JSON Array of Partitioned CRLs

Hi Dimitris, The Apple Root Program intends to use this field for all certificates in the future, but

unread,

CCADB Update: New field JSON Array of Partitioned CRLs

Hi Dimitris, The Apple Root Program intends to use this field for all certificates in the future, but

Aug 16

Ben Wilson, … Ryan Sleevi9

Aug 10

CA Survey Responses on Removing Old Roots

On Tue, Aug 10, 2021 at 5:05 AM Jesper Kristensen <jespermlst@gmail.com> wrote: Hi Ryan You

unread,

CA Survey Responses on Removing Old Roots

On Tue, Aug 10, 2021 at 5:05 AM Jesper Kristensen <jespermlst@gmail.com> wrote: Hi Ryan You

Aug 10

Jan Schaumann, … Ryan Sleevi4

Aug 6

Zimbabwe "banned from receiving certificates"

Ryan Sleevi <ryan@sleevi.com> wrote: > On Fri, Aug 6, 2021 at 3:05 PM 'Jan Schaumann

unread,

Zimbabwe "banned from receiving certificates"

Ryan Sleevi <ryan@sleevi.com> wrote: > On Fri, Aug 6, 2021 at 3:05 PM 'Jan Schaumann

Aug 6

Kathleen Wilson2

Aug 5

CCADB Update - August 5, 2021

The updates are completed. Please let me know if you run into any issues with using the CCADB. Thanks

unread,

CCADB Update - August 5, 2021

The updates are completed. Please let me know if you run into any issues with using the CCADB. Thanks

Aug 5

Watson Ladd, … Tim Callan4

Aug 5

Broader lessons from 1718771

We'd like to offer our own perspective on this issue, having lived it firsthand, in case this

unread,

Broader lessons from 1718771

We'd like to offer our own perspective on this issue, having lived it firsthand, in case this

Aug 5

Buschart, Rufus, … Ryan Sleevi32

Aug 4

Your opinion on misissuance under name constrained ICAs

On Wed, Aug 4, 2021 at 11:37 AM Buschart, Rufus <rufus.buschart@siemens.com> wrote: Thank you

unread,

Your opinion on misissuance under name constrained ICAs

On Wed, Aug 4, 2021 at 11:37 AM Buschart, Rufus <rufus.buschart@siemens.com> wrote: Thank you

Aug 4

Aaron Gable, Ryan Sleevi4

Aug 2

[meta] RSS Mailing List Archive

I've confirmed that mail-archive is now archiving the contents of this list. The RSS feed can be

unread,

[meta] RSS Mailing List Archive

I've confirmed that mail-archive is now archiving the contents of this list. The RSS feed can be

Aug 2

Buschart, Rufus, … Ryan Sleevi3

Jul 24

RE: Your opinion on misissuance under name constrained ICAs)

On Fri, Jul 23, 2021 at 6:54 PM Buschart, Rufus <rufus.buschart@siemens.com> wrote: This

unread,

RE: Your opinion on misissuance under name constrained ICAs)

On Fri, Jul 23, 2021 at 6:54 PM Buschart, Rufus <rufus.buschart@siemens.com> wrote: This

Jul 24

Ryan Hurst, … Matthew Hardeman24

Jul 14

IP Address Certificates via ACME

I believe the point that Matthias Merkel may be making is that there are, at present, multiple

unread,

IP Address Certificates via ACME

I believe the point that Matthias Merkel may be making is that there are, at present, multiple

Jul 14

Ben Wilson, … Sander Steenbergen16

Jul 7

Public Discussion of certSIGN's Externally Operated CA by KPN

Carefully reading through all the comments in this discussion has provided us with new insights. We

unread,

Public Discussion of certSIGN's Externally Operated CA by KPN

Carefully reading through all the comments in this discussion has provided us with new insights. We

Jul 7

James R Moir, … Aaron Gable5

Jul 1

Forward-date certificates?

Ah yeah, thanks for that perspective, that makes sense! Aaron On Tue, Jun 29, 2021 at 12:13 PM Ryan

unread,

Forward-date certificates?

Ah yeah, thanks for that perspective, that makes sense! Aaron On Tue, Jun 29, 2021 at 12:13 PM Ryan

Jul 1

James R Moir, … Stephen Davidson21

Jul 1

S/MIME certificate Subject

I'll take the opportunity to follow up on Ryan's introduction to the CA/Browser Forum's S

unread,

S/MIME certificate Subject

I'll take the opportunity to follow up on Ryan's introduction to the CA/Browser Forum's S

Jul 1

passerby184, … Jeremy Rowley9

Jun 25

Intermediate CAs that have both serverauth and Emailprotection extkeyusage

Both revocation and the CAB forum ballot changing the EKU requirement have effective dates. The

unread,

Intermediate CAs that have both serverauth and Emailprotection extkeyusage

Both revocation and the CAB forum ballot changing the EKU requirement have effective dates. The

Jun 25

Dimitris Zacharopoulos, … Ben Wilson8

Jun 24

Guidance for weekly updates on Bugzilla incidents

A CA can avoid posting repetitive, weekly "No updates" by posting a comment in the bug that

unread,

Guidance for weekly updates on Bugzilla incidents

A CA can avoid posting repetitive, weekly "No updates" by posting a comment in the bug that

Jun 24

Jun 24

CA Operations Community or Mailing-list?

I don't know if it is appropriate to discuss this in this mailing-list. If it NOT please let me

unread,

CA Operations Community or Mailing-list?

I don't know if it is appropriate to discuss this in this mailing-list. If it NOT please let me

Jun 24

Yuki Yuki, … Moudrick M. Dadashov8

Jun 21

What does it mean by “An executed Subscriber Agreement or Terms of Use”

Thanks Ryan, By "quite close" I meant the similarity (non contradictory) of these: "

unread,

What does it mean by “An executed Subscriber Agreement or Terms of Use”

Thanks Ryan, By "quite close" I meant the similarity (non contradictory) of these: "

Jun 21

Ben Wilson, … Matthew Hardeman4

Jun 19

Process for Considering Externally Operated Subordinate CAs

I echo this question of why not just require them to become direct root program participants? With

unread,

Process for Considering Externally Operated Subordinate CAs

I echo this question of why not just require them to become direct root program participants? With

Jun 19

Ben Wilson, Andrew Ayer4

Jun 15

Public Discussion of HARICA's Root CA Inclusion Requests

On May 19, 2021, we began the public discussion period [Step 4 of the Mozilla Root Store CA

unread,

Public Discussion of HARICA's Root CA Inclusion Requests

On May 19, 2021, we began the public discussion period [Step 4 of the Mozilla Root Store CA

Jun 15

Search

Clear search

Close search

Google apps

Main menu