Re: Incidents involving the CA WoSign

[percyalpha]

In most Chinese institutions, most checks and verifications are just formality. 
Contracting to the case of CNNIC CA, I'm not advocating for an outright removal 
of WoSign (even though I revoked the CA personally). But the incorrect 
notBefore date suggests that a mandatory inclusion of CT of all certs ever 
issued is needed. Of course, WoSign needs to address other issues raised by 
Matt and Ryan in addition to the CT requirement.
_______________________________________________
dev-security-policy mailing list
dev-security-policy@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-security-policy