Hello, we (OISTE) opened a bugzilla because a third party reported that we don't comply with the requirement to host test websites for EV certificates (valid, revoked, expired)... which was not the case, as we do host such websites. The problem here is that in the test websites section of our roots in CCADB we specified URLs that don't use EV certificates. I'm not being able to find a particular requirement to disclose the test websites using EV certificates in CCADB, and the EV guidelines only require to host such test websites, but not specifying the need or method to disclose them.
I think this could be solved in two possible ways: 1. Add specific guidance in CCADB, indicating to CAs that, if the Root is capable of issuing EV certificates, the test websites must use such EV certificates. 2. Add specific placeholders in the test websites section, to include URLs using EV certificates. Well, there's a third way, that would be to amend the TLS BR and/or EVGL to specify how and where to disclose the URLs of the test websites (e.g. in the CPS), but I think this can be easily solved if CCADB provides support and(or guidance to do this properly. Best, Pedro -- You received this message because you are subscribed to the Google Groups "CCADB Public" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion visit https://groups.google.com/a/ccadb.org/d/msgid/public/fee03097-5737-4ed2-9575-a58726994f3cn%40ccadb.org.
