All, Here, for your review and comment, is the final version of the wiki page guidance on providing auditor qualifications. I appreciate the input we

security-policy < > dev-security-policy@lists.mozilla.org> wrote: > >> Thanks Ben. >> >> >> >> What's the purpose of this statement

security-policy < > dev-security-policy@lists.mozilla.org> wrote: > >> On Saturday, March 6, 2021 at 11:17:53 PM UTC-5, bwi...@mozilla.com >> wrote

Root Store Policy, I'm proposing the > following sentence for section 6.1 - "A CA MUST ensure that it populates > the CCADB with the appropriate 'full CRL'

security-policy < dev-security-policy@lists.mozilla.org> wrote: > On Friday, February 12, 2021 at 10:27:11 AM UTC-6, Ben Wilson wrote: > > I'm fine with that

security-policy < > dev-security-policy@lists.mozilla.org> wrote: > >> On Sunday, January 3, 2021 at 8:38:05 AM UTC-6, Jeff Ward wrote: >> > On Tuesday

v. 2.7.1 a minor change that corrects a hyperlink issue in MRSP section 8. The link to "material change" here redirects to "alteration of instruments" - https

security-policy < >> dev-security-policy@lists.mozilla.org> wrote: >> >>> >>> How would that phrasing cover doppelgangers of intermediary

to explain policy constraints for EV audit exceptions in the MRSP. On Fri, Nov 6, 2020 at 4:43 PM Kathleen Wilson via dev-security-policy < dev-security-policy@lists.mozilla

Root Store Policy (v.2.7.1). > > #139 - Audits are > required even if no longer issuing - Clarify that audits are required until > the CA certificate is revoked, expired

security-policy wrote: > >> I see that this is related to >> https://github.com/mozilla/pkipolicy/issues/152, so I guess Mozilla >> Firefox does not enable

security-policy < dev-security-policy@lists.mozilla.org> wrote: > One potential option (5) would be to go even further than (2), and remove > the OCSP paragraph from

security-policy > wrote: > > I doubt it. So far, every CA that's decided to come up with their own > > method of proving key compromise has produced something entirely

exception for Policy Constraints – leaf certificates do not receive EV treatment unless signed by an intermediate CA with EV OID or anyPolicy OID, therefore they can be excluded from

Root Store Policy and Baseline Requirements." If an older root were to be submitted for inclusion that does not meet current requirements, there might be an argument that the

Root Store Policy. Issue #154 in GitHub proposes to require that management assertions (CA disclosures to auditors) provide written mention of all incidents occurring (or open)

to the 2.7.1 batch of proposed changes. I've started discussion of Issue 147, so we can discuss it there, or I can create a separate email thread for it. On Fri, Oct 2, 2020 at 5:16 AM