Re: [FORGED] Re: How Certificates are Verified by Firefox

2019-12-08 Thread Ryan Sleevi via dev-security-policy
On Sun, Dec 8, 2019 at 7:14 PM Eric Mill wrote: > On Thu, Dec 5, 2019 at 12:34 PM Ryan Sleevi via dev-security-policy < > dev-security-policy@lists.mozilla.org> wrote: > >> From looking at better security, the 'ideal' path is that modern clients >> are only trusting modern (new) roots, which

Re: [FORGED] Re: How Certificates are Verified by Firefox

2019-12-08 Thread Eric Mill via dev-security-policy
On Thu, Dec 5, 2019 at 12:34 PM Ryan Sleevi via dev-security-policy < dev-security-policy@lists.mozilla.org> wrote: > From looking at better security, the 'ideal' path is that modern clients > are only trusting modern (new) roots, which never issued old crappy certs. > That is, the path "D -> A