Remove old StartCom root certs from NSS

2017-07-10 Thread Kathleen Wilson via dev-security-policy
And I think we should remove the old StartCom root certs from NSS. Reference: https://wiki.mozilla.org/CA/Additional_Trust_Changes#StartCom ~~ Mozilla currently recommends not trusting any certificates issued by this CA after October 21st, 2016. That recommendation covers the following roots:

Remove old WoSign root certs from NSS

2017-07-10 Thread Kathleen Wilson via dev-security-policy
I also think we should remove the old WoSign root certs from NSS. Reference: https://wiki.mozilla.org/CA/Additional_Trust_Changes#WoSign ~~ Mozilla currently recommends not trusting any certificates issued by this CA after October 21st, 2016. That recommendation covers the following roots:

How long to resolve unaudited unconstrained intermediates?

2017-07-10 Thread Alex Gaynor via dev-security-policy
Hi all, I wanted to call some attention to a few intermediates which have been hanging out in the "Audit required" section for quite a while: https://crt.sh/mozilla-disclosures#disclosureincomplete Specifically, the TurkTrust and Firmaprofesional ones. Both have issues open in Bugzilla: -

RE: WoSign new system passed Cure 53 system security audit

2017-07-10 Thread Richard Wang via dev-security-policy
I think you found the source: https://bugzilla.mozilla.org/show_bug.cgi?id=1311824 Please note this email topic is just for releasing the news that WoSign new system passed the security audit, just for demonstration that we finished item 5: " 5. Provide auditor[3] attestation that a full

Re: WoSign new system passed Cure 53 system security audit

2017-07-10 Thread Itzhak Daniel via dev-security-policy
On Monday, July 10, 2017 at 9:00:04 AM UTC+3, Richard Wang wrote: > " 5. Provide auditor[3] attestation that a full security audit of the CA’s > issuing infrastructure has been successfully completed. " > " [3] The auditor must be an external company, and approved by Mozilla. " What is the

RE: WoSign new system passed Cure 53 system security audit

2017-07-10 Thread Richard Wang via dev-security-policy
Please note that the Mozilla requirement is: " 5. Provide auditor[3] attestation that a full security audit of the CA’s issuing infrastructure has been successfully completed. " " [3] The auditor must be an external company, and approved by Mozilla. " That WoSign did it very well -- PASS the