Frank Hecker wrote: > C.J. Adams-Collier wrote: > >> As Eddy said, discussion of ammendments to the Policy are a bit off topic >> for threads about certificate inclusion. >> > > Thanks for your suggestions. I've included some quick comments below. As > a general comment, I think it would be a good idea to create a document > for use by CAs, explaining in more detail the requirements of our > policy, and providing our recommendations on how to best satisfy the > various concerns we might have regarding the CAs' applications for > inclusion. > > My personal preference would be to create this document first (because > I think it's badly needed), and then to see which parts of the document > might make sense to include in the policy itself. (Note that we could > also incorporate such a document in the policy by reference.) > This is a good idea and we could start with a page on the Mozilla wiki or somewhere else. Would you mind creating an initial page at the location to your preference? Time allowing we could add our thoughts to it... > >> 1) This policy does leave a loophole in regards to domain ownership. It >> seems to me that the policy should make continued inclusion contingent on >> continued domain ownership by the entity originally requesting inclusion. >> > > I'm a bit confused here. Are you using the term "domain ownership" to > refer to the general question of who owns the CA? If so, I agree that > transfers of ownership and related events are issues that we should look > at for a future version of the policy. > I also didn't understand that correctly, since I was referring to domain ownership of the subscriber and this was somehow the reply to it...? > > > By "lingua franca" I presume you mean "English". I think this point is > debatable. In the past we have had at least one or two country-specific > CAs that had CPs or CPSs only in their native language, not English; in > those cases I got machine translations of the relevant CP/CPS sections > and confirmed my understanding with native speakers of the language. I > agree that it is preferable to have English versions of all documents, > but at the moment my inclination is to make this a recommendation, not a > mandatory requirement. Can you have a machine translation of Turkish, Arabic, Hebrew, Chinese etc? Except, that those translations are most of the time rather funny...
But any (serious) involvement by the community will be almost impossible in such a case, therefore I suggest to have at least the understanding that the CP/CPS should be in English...If we think about it more, Mozilla performs a certain judgment on behalf of the relying party, i.e. reading the CP/CPS of the relevant CA. I bet that you wouldn't "trust" a certificate if you couldn't read the CP/CPS to start with. -- Regards Signer: Eddy Nigg, StartCom Ltd. <http://www.startcom.org> Jabber: [EMAIL PROTECTED] <xmpp:[EMAIL PROTECTED]> Blog: Join the Revolution! <http://blog.startcom.org> Phone: +1.213.341.0390 _______________________________________________ dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
