Re: Policy 2.6 Proposal: Require disclosure of S/MIME validation practices

2018-03-30 Thread Wayne Thayer via dev-security-policy
ces+tim.hollebeek=digicert@lists.mozilla.org] On Behalf Of Wayne > > Thayer via dev-security-policy > > Sent: Monday, March 26, 2018 2:50 PM > > To: mozilla-dev-security-policy > <mozilla-dev-security-pol...@lists.mozilla.org> > > Subject: Policy 2.6 Proposal: Require

RE: Policy 2.6 Proposal: Require disclosure of S/MIME validation practices

2018-03-26 Thread Tim Hollebeek via dev-security-policy
On Behalf Of Wayne > Thayer via dev-security-policy > Sent: Monday, March 26, 2018 2:50 PM > To: mozilla-dev-security-policy <mozilla-dev-security-pol...@lists.mozilla.org> > Subject: Policy 2.6 Proposal: Require disclosure of S/MIME validation practices > > Mozilla policy s

Policy 2.6 Proposal: Require disclosure of S/MIME validation practices

2018-03-26 Thread Wayne Thayer via dev-security-policy
Mozilla policy section 2.2(2) requires validation of email addresses for S/MIME certificates, but doesn't require disclosure of these practices as it does for TLS certificates. I propose adding the following language from 2.2 (3) (TLS) to 2.2(2) (S/MIME): The CA's CP/CPS must clearly specify the