Re: Certinomis Issues

2019-04-18 Thread Matt Palmer via dev-security-policy
On Thu, Apr 18, 2019 at 12:29:05PM -0700, Wayne Thayer via dev-security-policy wrote: > Yesterday, Andrew Ayer reported two additional misissued certificates: > > * Space in SAN, issued yesterday: > https://bugzilla.mozilla.org/show_bug.cgi?id=1539531#c7 I'm starting to think Certnomis really

Re: Certinomis Issues

2019-04-18 Thread Wayne Thayer via dev-security-policy
Yesterday, Andrew Ayer reported two additional misissued certificates: * Space in SAN, issued yesterday: https://bugzilla.mozilla.org/show_bug.cgi?id=1539531#c7 * O=Entreprise TEST, issued in January: https://bugzilla.mozilla.org/show_bug.cgi?id=1496088#c20 I've added these to the issues list.

Re: Organization Identifier field in the Extended Validation certificates accordinf to the EVG ver. 1.6.9

2019-04-18 Thread Sándor dr . Szőke via dev-security-policy
> > Hopefully that made sense? Thanks for the information, the situation is not so bad as we thougth before. If I understand well, the same intermediate CA may issue EV and OV certificates, but the proper CP OID shall be included in the TLS certificate. It menas that the service provider

Re: Organization Identifier field in the Extended Validation certificates accordinf to the EVG ver. 1.6.9

2019-04-18 Thread Ryan Sleevi via dev-security-policy
On Thu, Apr 18, 2019 at 9:56 AM Sándor dr. Szőke via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > Thank you for the valuable information. > > > I try to summarize the possibilities to issue PSD2 QWAC certificates. > > - If a CA issues PSD2 QWAC certificate now, it SHALL

RE: Organization Identifier field in the Extended Validation certificates accordinf to the EVG ver. 1.6.9

2019-04-18 Thread Doug Beattie via dev-security-policy
Hi Sandor, You can follow the ballot status in the Server Certificate Working Group mail archives here: https://cabforum.org/pipermail/servercert-wg/ and specifically in this thread: https://cabforum.org/pipermail/servercert-wg/2019-April/000723.html Voting will start at least a week after the

Re: Organization Identifier field in the Extended Validation certificates accordinf to the EVG ver. 1.6.9

2019-04-18 Thread Sándor dr . Szőke via dev-security-policy
Thank you for the valuable information. I try to summarize the possibilities to issue PSD2 QWAC certificates. - If a CA issues PSD2 QWAC certificate now, it SHALL NOT include the CABF EV CPOID in it, but instead of that the certificate should contain the CABF OV CPOID value. - If the CA