> The unqualified mention of "September 8" confused me at first, but it > obviously refers to the "CAA Mandatory BR" taking effect on "September > 8, 2017", thus the single misissuance probably happened between > September 8, 2017 and when they changed the policy on August 31, 2018. > > However I cannot tell, because I can't find the serial number on crt.sh.
This appears to be the cert in question: https://crt.sh/?id=596401403&opt=ocsp Dates show they were revoked on the same day of the CPS update, so that explanation checks out for now _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy
