Re: GoDaddy: Failure to revoke certificate with compromised key within 24 hours

2020-05-20 Thread Matt Palmer via dev-security-policy
On Tue, May 19, 2020 at 07:33:00PM -0700, sandybar497--- via dev-security-policy wrote: > Here are the original headers (omitting my email) > > *** > > MIME-Version: 1.0 > Date: Thu, 7 May 2020 12:07:07 + > Message-ID: > > Subject: Certificate Problem Report - compromised key > From:

Re: GoDaddy: Failure to revoke certificate with compromised key within 24 hours

2020-05-20 Thread sandybar497--- via dev-security-policy
On Wednesday, May 20, 2020 at 3:03:01 AM UTC+10, Ryan Sleevi wrote: > On Tue, May 19, 2020 at 12:38 PM sandybar497--- via > dev-security-policy wrote: > > I actually submitted this post 6 days ago and was only just approved > > today.. is there a lack of resources approving blog posts? just

Re: Microsec: Issuance of 2 IVCP precertificates without givenName, surName, localityName fields

2020-05-20 Thread Sándor dr . Szőke via dev-security-policy
I inform you that as planned two days ago, Microsec today activated the new CA software release in the live system. The CA sofware has been improved to support more automatic checking for the presence of SN fields for different certificate profiles. As part of the project, Microsec has

Re: [FORGED] Re: Digicert issued certificate with let's encrypts public key

2020-05-20 Thread Peter Gutmann via dev-security-policy
Matthew Hardeman via dev-security-policy writes: >The standard use of the most common way of communicating the public key and >the purported proof-of-possession of the private key to the CA, the CSR, does >not provide replay protection and yet is frequently NOT treated as a security >impacting