Re: Policy 2.5 Proposal: Remove BR duplication: reasons for revocation

2017-05-01 Thread Gervase Markham via dev-security-policy
On 20/04/17 14:46, Gervase Markham wrote: > So, proposed new text: > > "CAs MUST revoke Certificates that they have issued upon the > occurrence of any event listed in the appropriate subsection of section > 4.9.1 of the Baseline Requirements (for email certificates, not > including those events

Re: Policy 2.5 Proposal: Remove BR duplication: reasons for revocation

2017-04-20 Thread Jakob Bohm via dev-security-policy
On 21/04/2017 00:36, Ryan Sleevi wrote: On Thu, Apr 20, 2017 at 6:15 PM, Jakob Bohm via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: Technically, the part after the @ could also be a bang!path, though this is rare these days. No, technically, it could not. RFC 5280,

Re: Policy 2.5 Proposal: Remove BR duplication: reasons for revocation

2017-04-20 Thread Ryan Sleevi via dev-security-policy
On Thu, Apr 20, 2017 at 6:15 PM, Jakob Bohm via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > > Technically, the part after the @ could also be a bang!path, though > this is rare these days. > No, technically, it could not. RFC 5280, Section 4.2.1.6. Subject Alternative

Re: Policy 2.5 Proposal: Remove BR duplication: reasons for revocation

2017-04-20 Thread Jakob Bohm via dev-security-policy
On 20/04/2017 21:15, Ryan Sleevi wrote: Gerv, I must admit, I'm not sure I understand what you consider irrelevant reasons for 4.9.1 in the context of e-mail addresses. The only one I can think of is "7. The CA is made aware that a Wildcard Certificate has been used to authenticate a

Re: Policy 2.5 Proposal: Remove BR duplication: reasons for revocation

2017-04-20 Thread Ryan Sleevi via dev-security-policy
Gerv, I must admit, I'm not sure I understand what you consider irrelevant reasons for 4.9.1 in the context of e-mail addresses. The only one I can think of is "7. The CA is made aware that a Wildcard Certificate has been used to authenticate a fraudulently misleading subordinate Fully-Qualified

Re: Policy 2.5 Proposal: Remove BR duplication: reasons for revocation

2017-04-20 Thread Gervase Markham via dev-security-policy
On 20/04/17 15:10, Jakob Bohm wrote: > Note that some reasons applicable to domain names would be equally > applicable to the domain name part of e-mail addresses. So can you read section 4.9.1 of the BRs and help me to define wording which excludes the irrelevant items while including all the