Re: [TLS] [DNSOP] [pkix] Cert Enumeration and Key Assurance With DNSSEC

[Paul Wouters <[e-mail]>]

On Mon, 4 Oct 2010, Phillip Hallam-Baker wrote:

> 2) Sanction CAs that issue unauthorized certificates

What would you say a valid sanction would be for a CA that issues a bad
certificate for 10 major websites like Mozilla and Yahoo?

What should the sanction be for a CA whose reseller's subCAs issues such
bad certificates?

What would the sanctions be for non-FQDN EV certs issued?

What would the current total sanction be for Comodo, a player who has
someone as honourable as you working for them based on last year's events
plus EV violations detected via the SSL observatory data?

How could an external party review the set of unknown serials revoked by
Comodo to determine the kind/amount of sanction?

Would Comodo's "licencse" have been revoked, or would the sanctions have
been limited by money? If so, would the money be in absolute value or
percantage of profit/turnover?

What would or could Comodo have done differently if such a sanction had
been applied?




There is really only one sanction everyone can determine by themselves
to apply to any CA, the decision to trust them more or less then
themselves. If the latter, DNSSEC with DANE is an excellent choice. Feel
free to interpret DANE as each TLS owner's "sanction".

Paul