Re: [pkix] A non-compliant use of the EKU extension in Mozilla's CA Certificate Policy Version 2.1.

[Erwann Abalea <[e-mail]>]

Bonjour,

2013/2/19 Denis Pinkas <[e-mail]>
[...]

> Mozilla announces on
> https://lists.mozilla.org/listinfo/dev-security-policy: “*The subscribers
> list is only available to the list administrator”. *
>

That's classic.


> So it is quite hard to know who was on the discussion list and thus who
> participated to the discussion.
>

No, the list itself is public. You can use their newsgroup server, or
Google Groups to access it.
The discussion is accessible here
https://groups.google.com/forum/?fromgroups=#!topic/mozilla.dev.security.policy/Rbc-5j6i-vY


> ****
>
> Since the publication is recent (February 14, 2013), it might be
> appropriate to ask to the Mozilla community to respect the compliance
> to the standards. In order to fulfil its needs, the Mozilla community
> should:****
>
> -          either define its own extension,****
>
> -          or, propose a new extension so that it can be published in an
> RFC according to the IETF rules.****
>
>
I proposed to rely on certificatePolicies extension. That's the purpose of
this extension. Unfortunately, it's often incorrectly used, so that would
need a cleaning step and a definition of standardized policyIds for
specific purposes.

-- 
Erwann.