RE: Audits for new subCAs

2018-03-28 Thread Buschart, Rufus via dev-security-policy
Operating a technically unconstrained issuing CA, Siemens CA (aka TSP) does something very similar in case a new CA is necessary: * In an audited ceremony based on the operational and technical controls audited in the last annual audit a key pair is generated on one of the HSMs * A CSR is

Re: Audits for new subCAs

2018-03-28 Thread Bruce via dev-security-policy
Entrust does the following: - Each subCA certificate is created through a audited ceremony. The auditor creates a report indicating the key ID and the CPS which was used for key generation. - When it is time for the subCA to go into production, an intermediate certificate is issued from a root.

Re: AC Camerfirma Chambers of Commerce and Global Chambersign 2016 Root Inclusion Request

2018-03-28 Thread ramirommunoz--- via dev-security-policy
On Wednesday, March 28, 2018 at 7:34:25 AM UTC+2, Adrian R. wrote: > Hello > can you please sign the PDF files on that site? > > the very first page of CPS_eidas_EN_v_1_2_3.pdf says > "Document valid only in digital format digitally signed by the Policy > Authority" > > but the PDF that i was

Re: AC Camerfirma Chambers of Commerce and Global Chambersign 2016 Root Inclusion Request

2018-03-28 Thread ramirommunoz--- via dev-security-policy
On Tuesday, March 27, 2018 at 10:37:07 PM UTC+2, Wayne Thayer wrote: > Hi Ramiro, > > On Fri, Mar 23, 2018 at 11:52 AM, ramirommunoz--- via dev-security-policy < > dev-security-policy@lists.mozilla.org> wrote: > > > Hi Ryan > > > > Thanks again for your remarks. > > In the end I am going to