Re: Forbidden Practices: Subscriber key generation

2017-11-22 Thread Gervase Markham via dev-security-policy
On 14/11/17 21:53, Doug Beattie wrote > The question is, if we issue Code Signing certificates via P12 files > in compliance with the Code Signing standard, are we out of > compliance with the Mozilla policy? How do you recommend we respond > to this checklist question? Mozilla does not have

Forbidden Practices: Subscriber key generation

2017-11-14 Thread Doug Beattie via dev-security-policy
Hi Gerv and Kathleen, We're working on the Mozilla CA self-assessment checklist and referenced requirements you have placed on CAs. On your page of Forbidden or Problematic Practices [1], you state that CAs must not generate private keys for signer certificates. CAs must never generate the