DigiCert/Symantec updates

2017-11-15 Thread Jeremy Rowley via dev-security-policy
Hey everyone, I wanted to give the community and update on how the DigiCert-Symantec transition is going and make everyone aware of a few issues I recently created on Bugzilla. First, the good news. DigiCert has started validating and issuing certificates through the Symantec platform

CCADB Report: AllCertificateRecordsCSVFormat

2017-11-15 Thread Kathleen Wilson via dev-security-policy
All, The following report lists data for all root and intermediate cert records in the CCADB. https://ccadb-public.secure.force.com/mozilla/AllCertificateRecordsCSVFormat A link to this report is here: http://ccadb.org/resources Cheers, Kathleen

Re: Question on CAA processing for mixed wildcard and non-wildcard SAN DNS names

2017-11-15 Thread cbonnell--- via dev-security-policy
On Wednesday, November 15, 2017 at 8:11:18 AM UTC-5, Quirin Scheitle wrote: > Hi all, > > I have a question regarding processing of CAA records for “wildcard > certificates”. > > Let’s assume the following CSR: > > X509v3 Subject Alternative Name: >DNS: *.example.com >

Question on CAA processing for mixed wildcard and non-wildcard SAN DNS names

2017-11-15 Thread Quirin Scheitle via dev-security-policy
Hi all, I have a question regarding processing of CAA records for “wildcard certificates”. Let’s assume the following CSR: X509v3 Subject Alternative Name: DNS: *.example.com DNS: example.com Per BR, every SAN DNS name must be checked separately. Now, my

AW: Swiss Government root inclusion request

2017-11-15 Thread Michael von Niederhäusern via dev-security-policy
Hi Wayne Thank you for the review of our CP/CPS. Please find our answers to your findings/questions below. >> I reviewed the CP/CPS, BR self assessment, audit statement, and other >> information provided as part of this request. Overall, I found the CPS and >> BR self assessment to be lacking

Re: .tg Certificates Issued by Let's Encrypt

2017-11-15 Thread Nick Lamb via dev-security-policy
On Tuesday, 14 November 2017 16:31:34 UTC, Kathleen Wilson wrote: > Based on information from folks that are monitoring their NS Records, we > believe that the .tg Registry problems were fixed on November 1, and > have remained fixed since then. > > I have not looked into how Registries are