Frank Hecker schrieb: > Second, in the case of T-Systems the issue seems to be that T-Systems > functions primarily as a root CA, not as a CA issuing end-entity > certificates. Therefore the T-Systems CPS does not address practices > relating to issuance of end-entity certificates.
> The solution seems to > be that we need to look at the CPS documents for DFN and other > subordinate CAs of T-Systems, or obtain some other public statement > about the practices of these subordinate CAs. To the folks at DFN/T-Systems: Wolfgang wrote: "Yes, subordinate CAs may be external to T-Systems. Nevertheless they are part of the audit in that way, that the auditor did prove our process to register and issue subordinate CAs." So it could perhaps be possible to get a detailed statement from the auditor about the process of approving sub CAs? Thorsten _______________________________________________ dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
