Responsible CA Management

2015-05-06 Thread Gary Mort
It has been clear to me for quite some time that the current policies do nothing to encourage responsible CA management. CA policies continue to be based on maintaining legal deniability and opaque processes. Consider Mozilla's own EV Certificate: https://bugzilla.mozilla.org/show_bug.cgi?id=4

What is the goal of maintaining a CA Root List?

2014-07-18 Thread Gary Mort
Looking over the Mozilla at http://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/ I can't really find a good clear reason why Mozilla would maintain and distribute this list to begin with. There are many implied reasons in the policies themselves, but those implied