Re: DRAFT - BR Self Assessments

2017-04-24 Thread Kathleen Wilson via dev-security-policy
On Saturday, April 22, 2017 at 5:25:35 AM UTC-7, wangs...@gmail.com wrote: > We have a question about completing the BR self assessment,  > is it necessary that all the BRs requirements appear in  > relevant sections of the CP/CPS?  It is OK if the information is in different sections in the

Re: DRAFT - BR Self Assessments

2017-04-22 Thread wangsn1206--- via dev-security-policy
在 2017年4月4日星期二 UTC+8上午1:47:34,Kathleen Wilson写道: > I updated https://wiki.mozilla.org/CA:BRs-Self-Assessment to add a section > called 'Annual BR Self Assessment', which states: > "CAs with included root certificates that have the Websites trust bit set > must do an annual self-assessment of

Re: DRAFT - BR Self Assessments

2017-04-03 Thread Kathleen Wilson via dev-security-policy
I updated https://wiki.mozilla.org/CA:BRs-Self-Assessment to add a section called 'Annual BR Self Assessment', which states: "CAs with included root certificates that have the Websites trust bit set must do an annual self-assessment of their compliance with the BRs, and must update their CP

Re: DRAFT - BR Self Assessments

2017-03-29 Thread Kathleen Wilson via dev-security-policy
On Wednesday, March 29, 2017 at 2:00:05 PM UTC-7, Jeremy Rowley wrote: > ... > An extension on this could be to have CAs annually file an updated mapping > with their WebTrust audit. That way it's a reminder that the CA needs to > notify Mozilla of changes in their process and keeps the CAs

RE: DRAFT - BR Self Assessments

2017-03-29 Thread Jeremy Rowley via dev-security-policy
, 2017 11:55 AM To: mozilla-dev-security-pol...@lists.mozilla.org Subject: DRAFT - BR Self Assessments All, As mentioned in the GDCA discussion[1], I would like to add a step to Mozilla's CA Inclusion/Update Request Process[2] in which the CA performs a self-assessment about their compliance

DRAFT - BR Self Assessments

2017-03-29 Thread Kathleen Wilson via dev-security-policy
All, As mentioned in the GDCA discussion[1], I would like to add a step to Mozilla's CA Inclusion/Update Request Process[2] in which the CA performs a self-assessment about their compliance with the CA/Browser Forum's Baseline Requirements. A draft of this new step is here: