Re: TURKTRUST Non-compliance

2018-03-16 Thread Eric Mill via dev-security-policy
In TurkTrust's 2016 email noting that they were suspending their TLS certificate business, they noted it stemmed mainly from not being accepted to all major root stores (Apple did not accept them). Therefore, the sites using these certificates are not trusted by some major client bases, which is

TURKTRUST Non-compliance

2018-03-16 Thread Wayne Thayer via dev-security-policy
TURKTRUST has the "TÜRKTRUST Elektronik Sertifika Hizmet Sağlayıcısı H5" root included in the Mozilla program with the 'websites' trust bit enabled (not EV). Crt.sh identifies one unexpired and unrevoked subordinate CA [1], and 13 unexpired end-entity certificates signed by this root [2]. The

Re: 2018.03.12 Let's Encrypt Wildcard Certificate Encoding Issue

2018-03-16 Thread József Szilágyi via dev-security-policy
Please put also this certificate on that list: https://crt.sh/?id=181538497=cablint,x509lint Best Regards, Jozsef ___ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy

Logius PKIoverheid response to Action #2 in the January 2018 CA Communication

2018-03-16 Thread Berge, J. van den (Jochem) - Logius via dev-security-policy
Dear MSDP community, As requested by Mozilla in the CA Communication survey we've reviewed our implementation of BR 3.2.2.4.1 and 3.2.2.4.5. PKIoverheid only issues OV/EV certificates to subscribers for which the applicant representative has to have had a face-to-face check to confirm the

Re: Mis-issuance of certificate with https in CN/SAN

2018-03-16 Thread Rob Stradling via dev-security-policy
On 16/03/18 05:17, Jakob Bohm via dev-security-policy wrote: Please see https://crt.sh/?id=353098570=cablint Note: This is the CT precertificate. Note 2: According to crt.sh, the OCSP response for this precertificate is not correct.  (error message: "OCSP response contains bad number of