Hi, >The comment from https://bugzilla.mozilla.org/show_bug.cgi?id=392024#c42 >and further in comment 44 suggests that there *are* external sub >ordinate CA certificates. Do we know how many and if they were included >in the audits? Also will they be part of the audits or are only the >controls of the CA audited? >I'm not sure if there are explicit provisions in the CPS concerning the >requirements to external entities having their own (sub) CA at their >premises and their audit requirements (beyond internal controls of the >CA). Can we get some more information on that?
There are a small number of external CAs that have been signed by our root. They are not part of a formal audit but our Director of Security does audit and review their CPS'. There are no requirements for the external entities to undergo third party audits unless we decide that it is necessary. We have the right to impose this requirement in our contract with the external entities. Best regards, Rolf -- Dr. Rolf Lindemann Director Product Management TC TrustCenter GmbH Sonninstrasse 24-28, 20097 Hamburg Office: +49 40 808026-300 Fax: +49 40 808026-126 Email: lindem...@trustcenter.de www.trustcenter.de ---------------- TC TrustCenter ist Sponsor des Gartner IAM Summit 2009 am 23. 24. März 2009, Royal Lancaster Hotel in London. Sichern Sie sich bei uns einen 20% Rabatt für dieses hochkarätige Event und erfahren Sie vor Ort mehr über unsere On Demand Digital Identity Lösungen als Katalysator für Ihr Business. ---------------- TC TrustCenter is sponsor at the Gartner IAM Summit 2009 at 23. - 24. March 2009, Royal Lancaster Hotel in London. As a sponsor of this event we are pleased to be able to offer you a special 20% discount on the standard delegate rate.Visit our booth to find out how your company can profit from our On Demand Digital Identity services as the key component for business driven IT processes. ---------------- Geschaeftsfuehrung/Managing Directors: Robert Steinkrauss, Dr. Sabine Kockskaemper AG Hamburg, HRB 96168 This email may contain confidential and privileged material for the sole use of the intended recipient. Any review or distribution by others is strictly prohibited. If you are not the intended recipient please contact the sender and delete all copies.
smime.p7s
Description: S/MIME cryptographic signature
-- dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
