Re: Odp.: Odp.: Odp.: 46 Certificates issued with BR violations (KIR)

2019-02-02 Thread Dimitris Zacharopoulos via dev-security-policy
+1. Of course there must be consistency between CRLs and OCSP. Dimitris. -Original Message- From: Eric Mill via dev-security-policy To: "Buschart, Rufus" Cc: mozilla-dev-security-policy , Kurt Roeckx , Wayne Thayer Sent: Sat, 02 Feb 2019 16:17 Subject: Re: Odp.: Odp.: Odp.: 46

Re: Odp.: Odp.: Odp.: 46 Certificates issued with BR violations (KIR)

2019-02-02 Thread Eric Mill via dev-security-policy
The BRs and Mozilla program policies don't support the idea of just trusting a CA to issue certs for "internal" use or to keep them secret. This is why CAs issuing "test certificates" on production CAs for domains they don't own is clearly forbidden. Given that, I don't see how it can be

AW: Odp.: Odp.: Odp.: 46 Certificates issued with BR violations (KIR)

2019-02-02 Thread Buschart, Rufus via dev-security-policy
Personally I think it would be better, if the revoke reason "Certificate hold" on the CRL would be allowed for TLS certificates, as this state would exactly cover the described scenario. The OCSP responder could in such a case reply with "bad" and deliver the reason "certificate hold". But I