RE: Incident Report: Test revoked certificates created with an incorrect validity period

2019-02-15 Thread Ponds-White, Trevoli via dev-security-policy
Thanks for following up on this Ryan. Test certificates from these CAs were first generated in October 2015 with 39 month validity. While we had ceremonies since that time as part of the controls for WebTrust audit, we did not include renewal of these certificates until 2019. We did and do

Re: Request to Include Hongkong Post Root CA 3

2019-02-15 Thread Wayne Thayer via dev-security-policy
I have confirmed that the problems identified with the CPS have been corrected. [1] Regarding the comments from Ian on the BR violations in 2016 that resulted in adding an intermediate to OneCRL [2], this appears to have been the result of the belief that was held by many CAs at that time that

Re: Certificate issued with OU > 64

2019-02-15 Thread Ryan Sleevi via dev-security-policy
On Fri, Feb 15, 2019 at 12:01 PM Jakob Bohm via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > Indeed, the report states that the bug was in the pre-issuance checking > software. > I believe you may have misread the report. I do not have the same impression - what is

Re: Certificate issued with OU > 64

2019-02-15 Thread Jakob Bohm via dev-security-policy
On 15/02/2019 15:21, Ryan Sleevi wrote: (Sending from the right e-mail) On Fri, Feb 15, 2019 at 8:05 AM info--- via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: Hi, this is the incident report: 1. How your CA first became aware of the problem (e.g. via a problem

Re: Certificate issued with OU > 64

2019-02-15 Thread Wayne Thayer via dev-security-policy
Thank you for the incident report. I have created a bug for tracking: https://bugzilla.mozilla.org/show_bug.cgi?id=1528290 - Wayne On Fri, Feb 15, 2019 at 7:21 AM Ryan Sleevi via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > (Sending from the right e-mail) > > On Fri,

Re: Certificate issued with OU > 64

2019-02-15 Thread Ryan Sleevi via dev-security-policy
(Sending from the right e-mail) On Fri, Feb 15, 2019 at 8:05 AM info--- via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > Hi, this is the incident report: > > 1. How your CA first became aware of the problem (e.g. via a problem > report submitted to your Problem

Re: Certificate issued with OU > 64

2019-02-15 Thread info--- via dev-security-policy
Hi, this is the incident report: 1. How your CA first became aware of the problem (e.g. via a problem report submitted to your Problem Reporting Mechanism, a discussion in mozilla.dev.security.policy, a Bugzilla bug, or internal self-audit), and the time and date. We have controls to