Re: OCSP Responder monitoring (was Re: Violations of Baseline Requirements 4.9.10)

2017-12-19 Thread Wayne Thayer via dev-security-policy
Thanks Rob! I went through the list and filed a bug for each CA if there wasn't one already open (with one exception that I'm still researching). All open OCSP issues are included in the list at https://wiki.mozilla.org/CA/Incident_Dashboard Wayne On Mon, Dec 11, 2017 at 10:49 PM, Rob Stradling

RE: ComSign Root Renewal Request

2017-12-19 Thread Doug Beattie via dev-security-policy
Hi Wayne, I noticed your comment on IDN validation. Is there a requirement that CAs establish an effective safeguard against homograph spoofing? The reason I ask is that Let's Encrypt's CPS says this: "Regarding Internationalized Domain Names, ISRG will have no objection so long as the

Re: On the value of EV

2017-12-19 Thread Gijs Kruitbosch via dev-security-policy
On 18/12/2017 21:54, Andrew wrote: On Monday, December 18, 2017 at 3:09:31 PM UTC-6, Wayne Thayer wrote: Thank you Ryan for raising this question, and to everyone who has been contributing in a constructive manner to the discussion. A number of excellent points have been raised on the

Re: ComSign Root Renewal Request

2017-12-19 Thread YairE via dev-security-policy
Thank you again, On section 1 - we now added links to the current BR etc, and removed the "annual" update so we are bound to update anytime a new version is released. About the homograph spoofing - we have changed the section so now it tells its only automatic (because as you have pointed,