On Wed, Sep 20, 2017 at 12:37 AM, Martin Rublik via dev-security-policy <dev-security-policy@lists.mozilla.org> wrote: > On Tue, Sep 19, 2017 at 5:22 PM, Alex Gaynor via dev-security-policy < > dev-security-policy@lists.mozilla.org> wrote: > >> https://crt.sh/mozilla-certvalidations?group=version&id=896972 is a very >> informative graph for me -- this is the number of validations performed by >> Firefox for certs under this CA. It looks like at the absolute peak, there >> were 1000 validations in a day. That's very little value for our users, in >> return for an awful lot of risk. >> >> Alex > > > Hi, > > I agree that 1000 validations in a day is not much, or better to say really > low number. Anyway I was wondering what should be a minimum value or > whether this number is a good metric at all. I went through the Mozilla > validations telemetrics and there are more CAs with similliar number of > validations.
Note that Firefox 55 had a regression on how it does chain building (https://bugzilla.mozilla.org/show_bug.cgi?id=1400913) that causes it prefer the longest chain rather than the shortest chain. This means, for Root CAs that are cross-signed, Firefox 55 will frequently attribute to the wrong bucket. The total on the buckets does not change, but the validations per day did shift. For example, Firefox 55 shows "AddTrust External CA Root" is a super popular root while prior versions had "COMODO RSA Certification Authority" as a top root. "Go Daddy Class 2 CA" and "Go Daddy Root Certificate Authority - G2" also flipped in Firefox 55. This does not impact the Visa bucket, as far as I know, as the Visa root is not cross-signed by any other root. Thanks, Peter _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
