Re: The case for point in time readiness audits (PITRAs)

2014-09-02 Thread Kathleen Wilson
I updated the wiki page some more, here's the text... https://wiki.mozilla.org/CA:BaselineRequirements#BR_Point_in_Time_Readiness_Assessment_.28BR_PITRA.29 == BR Point in Time Readiness Assessment (BR PITRA) == We previously said: Any Certificate Authority being considered for root inclusion

Re: The case for point in time readiness audits (PITRAs)

2014-09-02 Thread Man Ho (Certizen)
On 9/3/2014 4:26 AM, Kathleen Wilson wrote: I updated the wiki page some more, here's the text... https://wiki.mozilla.org/CA:BaselineRequirements#BR_Point_in_Time_Readiness_Assessment_.28BR_PITRA.29 == BR Point in Time Readiness Assessment (BR PITRA) == We previously said: Any Certificate

Re: The case for point in time readiness audits (PITRAs)

2014-08-28 Thread Kathleen Wilson
On 8/26/14, 4:14 PM, Kathleen Wilson wrote: I updated the wiki page to make it more clear that I am concerned about the case where the CA did not know about the BRs, so there are an unknown number of certs in that CA hierarchy that do not conform to the BRs.

Re: The case for point in time readiness audits (PITRAs)

2014-08-26 Thread Kathleen Wilson
On 8/21/14, 8:59 AM, Kathleen Wilson wrote: On 8/20/14, 5:30 PM, kirk_h...@trendmicro.com wrote: Sorry for this late response, but Peter Bowen's post below in subpart 2) is exactly correct - FF needs to accept PITRAs from new CA roots, or else you will never have any new CA roots. I updated

Re: The case for point in time readiness audits (PITRAs)

2014-08-21 Thread Kathleen Wilson
On 8/20/14, 5:30 PM, kirk_h...@trendmicro.com wrote: Sorry for this late response, but Peter Bowen's post below in subpart 2) is exactly correct - FF needs to accept PITRAs from new CA roots, or else you will never have any new CA roots. I updated the wiki page to make it more clear that I

The case for point in time readiness audits (PITRAs)

2014-08-20 Thread kirk_h...@trendmicro.com
Sorry for this late response, but Peter Bowen's post below in subpart 2) is exactly correct - FF needs to accept PITRAs from new CA roots, or else you will never have any new CA roots. No customer will accept certs from a CA's new roots unless they are already in the major browsers (possibly