Re: Allow Redaction of issues detailed in BR Audit statements?

2014-08-27 Thread Matt Palmer
On Thu, Aug 28, 2014 at 09:42:13AM +0800, Man Ho (Certizen) wrote: Concerning about a list of BRs that the CA is still working to conform with, I don't think CAs will agree to publish in public for security reason and also because of business sensitivity. I think some CAs don't even want to

Re: Allow Redaction of issues detailed in BR Audit statements?

2014-08-26 Thread Matt Palmer
Hi Kathleen, My take on this is that any information that is relevant to a CA's conformance (or lack thereof) with the BRs (or any other part of Mozilla's inclusion criteria) needs to be disclosed to those who are passing judgment on the suitability of the CA for inclusion in the Mozilla trust

Re: Proposal: Switch generic icon to negative feedback for non-https sites

2014-08-10 Thread Matt Palmer
On Sat, Aug 09, 2014 at 04:53:46PM -0700, David E. Ross wrote: Anyone wishing to argue this issue further -- to argue in favor of implementing a scheme to encourage all Web sites to be HTTPS with site certificates -- should first read

Re: Proposal: Switch generic icon to negative feedback for non-https sites

2014-08-10 Thread Matt Palmer
On Sun, Aug 10, 2014 at 08:16:42PM -0700, David E. Ross wrote: On 8/10/2014 4:09 PM, Matt Palmer wrote: On Sat, Aug 09, 2014 at 04:53:46PM -0700, David E. Ross wrote: Anyone wishing to argue this issue further -- to argue in favor of implementing a scheme to encourage all Web sites

Re: GlobalSign Request to Include ECC Roots

2014-07-30 Thread Matt Palmer
OK, let's dive into the CPS dissection game... On Tue, Jul 29, 2014 at 03:26:08PM -0700, Kathleen Wilson wrote: ** CPS section 3.2.2.3, Extended Validation Certificates (SSL and Code Signing): For Extended Validation Certificates, the EV Guidelines are followed. I'm new to this, so perhaps

Re: Dynamic Path Resolution in AIA CA Issuers

2014-07-30 Thread Matt Palmer
On Wed, Jul 30, 2014 at 12:17:27PM -0700, Kathleen Wilson wrote: On 7/28/14, 11:00 AM, Brian Smith wrote: I suggest that, instead of including the cross-signing certificates in the NSS certificate database, the mozilla::pkix code should be changed to look up those certificates when attempting

<    1   2   3   4