On Monday, October 10, 2016 at 1:08:24 PM UTC-7, Ryan Sleevi wrote: > On Monday, October 10, 2016 at 11:39:19 AM UTC-7, Kathleen Wilson wrote: > > I would like to remind everyone that when making decisions about what to do > > about CA mis-issuance, it is expressly *not* a goal for me to mete out > > punishment. Rather, my primary goal is to help keep end-users safe, based > > on the information that is available. > <snip> > That is, if we accept that the sole role of the program is to respond to > ensure incidents are contained,
I did not say that my goal was solely to contain incidents! :-( I said that my goal is to help keep end-users safe. Here's what I mean by that... If a CA has lost my faith in their ability to uphold Mozilla's policies, then I don't think they should be able to continue issuing certs chaining up to root certs in NSS until they re-gain my faith in their ability to uphold Mozilla's policies. > > If we take the view that the primary goal is to keep end users safe, then we > could say at the time of expiration, that goal was met, and no further action > was necessary. I completely disagree! CNNIC lost my confidence in their ability to uphold Mozilla's policies. For me, the resulting action items were not about punishing CNNIC, and not solely about containment of the incident. It was about taking that CA out of the system until they could re-gain my confidence in their ability to meet and uphold Mozilla's policies. Based on the information that I have seen regarding WoSign, I believe that WoSign intentionally bent the rules in order to continue issuing SHA-1 SSL certs, when they knew full well that was no longer allowed. WoSign has lost my confidence in their ability and intention to follow Mozilla's policies. > Though we should not strive to have CA's "yo-yo in", as Gerv put it - and I > am a strong believer that *any* future trust *must* involve new keys I think what you are saying is that the CA needs to re-apply for inclusion with new root certificates (not their old root certs). Correct? If yes, I am inclined towards that idea too. I've heard that it would cause continuity issues, but I don't get that. Seems to me that *if* the CA were to get their new root approved/included, that they could resume issuing from their new root instead of their old root. In any case, Gerv's proposal outlined a set of things that the CA would need to do in order to re-apply for inclusion. I'm inclined to agree with much of Gerv's proposal, but I'm still pondering this: "This distrust would remain for a minimum of 1 year. After that time, WoSign/StartCom may be readmitted to the Mozilla trust program, under the following conditions:..." Why do we need a minimum of 1 year? What purpose does that serve? If they meet all our requirements earlier, why couldn't we discuss it earlier than 1 year? Cheers, Kathleen _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
