RE: Remove old WoSign root certs from NSS

2017-08-29 Thread Richard Wang via dev-security-policy
Please stop to misleading the audience, the first news has link that refer to second news. We have provided best service for our customer more than 10 years that we are continue as always, to provide high quality pre-sale and after-sales service for our customers. Best Regards, Richard

RE: Violations of Baseline Requirements 4.9.10

2017-08-29 Thread Ben Wilson via dev-security-policy
This CA is technically constrained: DN: C=CH, L=Zurich, O=ABB, CN=ABB Issuing CA 6 From: Paul Kehrer [mailto:paul.l.keh...@gmail.com] Sent: Tuesday, August 29, 2017 6:48 AM To: mozilla-dev-security-pol...@lists.mozilla.org Subject: Violations of Baseline Requirements 4.9.10 I've

Re: Remove old WoSign root certs from NSS

2017-08-29 Thread Percy via dev-security-policy
On Sunday, August 27, 2017 at 10:59:48 PM UTC-7, Richard Wang wrote: > We released replacement notice in Chinese in our website: > https://www.wosign.com/news/announcement-about-Microsoft-Action-20170809.htm > https://www.wosign.com/news/announcement-about-Google-Action-20170710.htm >

Re: Violations of Baseline Requirements 4.9.10

2017-08-29 Thread Policy Authority PKIoverheid via dev-security-policy
> Government of The Netherlands, PKIoverheid (Logius) > > DN: C=NL, O=KPN Corporate Market BV, CN=KPN Corporate Market CSP > Organisatie CA - G2 > Example cert: > https://crt.sh/?q=f821a600af00d2fa23f569e00fdf2379bc182920205a6b9b0276733cb2857c15 > OCSP URI: http://ocsp2.managedpki.com Hi Paul,

Re: Violations of Baseline Requirements 4.9.10

2017-08-29 Thread identrust--- via dev-security-policy
On Tuesday, August 29, 2017 at 12:51:05 PM UTC-4, Ryan Sleevi wrote: > On Tue, Aug 29, 2017 at 8:47 AM, Paul Kehrer via dev-security-policy < > dev-security-policy@lists.mozilla.org> wrote: > > > > Symantec / GeoTrust > > > > CCADB does not list an email address. Not CC'd. > > > > DN: C=IT,

Re: Violations of Baseline Requirements 4.9.10

2017-08-29 Thread Ryan Sleevi via dev-security-policy
On Tue, Aug 29, 2017 at 8:47 AM, Paul Kehrer via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > > Symantec / GeoTrust > > CCADB does not list an email address. Not CC'd. > > DN: C=IT, O=UniCredit S.p.A., CN=UniCredit Subordinate External > Example cert: >

RE: Violations of Baseline Requirements 4.9.10

2017-08-29 Thread Ben Wilson via dev-security-policy
This CA only issues client certificates: DN: CN=Cartão de Cidadão 001, OU=ECEstado, O=SCEE - Sistema de Certificação Electrónica do Estado, C=PT Ben Wilson, JD, CISA, CISSP VP Compliance +1 801 701 9678 From: Paul Kehrer [mailto:paul.l.keh...@gmail.com] Sent: Tuesday, August

RE: Violations of Baseline Requirements 4.9.10

2017-08-29 Thread Stephen Davidson via dev-security-policy
Hello: Many thanks. The CA listed for Government of The Netherlands, PKIoverheid (Logius) is operated by KPN Corporate Market not QuoVadis. We will pass on the information to PKIoverheid. Government of The Netherlands, PKIoverheid (Logius) Email sent to supp...@quovadisglobal.com DN: C=NL,

Violations of Baseline Requirements 4.9.10

2017-08-29 Thread Paul Kehrer via dev-security-policy
I've recently completed a scan of OCSP responders with a focus on checking whether they are compliant with BR section 4.9.10's requirement: "Effective 1 August 2013, OCSP responders for CAs which are not Technically Constrained in line with Section 7.1.5 MUST NOT respond with a "GOOD" status for

RE: SHA-1 Usage in OCSP Responder

2017-08-29 Thread Doug Beattie via dev-security-policy
Hi Harshal, Yes, we took the option of pre-generating some OCSP signing certificates in 2016 for use in 2017 and 2018 vs. creating long validity OCSP signing certificates or moving to SHA-256. Since the not-before dates are in 2017 when this would have been prohibited, so we posted them to CT

SHA-1 Usage in OCSP Responder

2017-08-29 Thread Harshal Sheth via dev-security-policy
Hello, The following certificates are using the SHA-1 signature algorithm. They will all be valid for approximately three months in 2018, as none have been revoked thus far. https://crt.sh/?id=62407589=cablint https://crt.sh/?id=62416636=cablint https://crt.sh/?id=62423790=cablint

Re: Regarding CA requirements as to technical infrastructure utilized in automated domain validations, etc. (if any)

2017-08-29 Thread Jakob Bohm via dev-security-policy
On 28/08/2017 10:15, Nick Lamb wrote: I think that instead Ryan H is suggesting that (some) CAs are taking advantage of multiple geographically distinct nodes to run the tests from one of the Blessed Methods against an applicant's systems from several places on the Internet at once. This

Re: Regarding CA requirements as to technical infrastructure utilized in automated domain validations, etc. (if any)

2017-08-29 Thread Ryan Hurst via dev-security-policy
On Monday, August 28, 2017 at 1:15:55 AM UTC-7, Nick Lamb wrote: > I think that instead Ryan H is suggesting that (some) CAs are taking > advantage of multiple geographically distinct nodes to run the tests from one > of the Blessed Methods against an applicant's systems from several places on