Jeremy Rowley

Product dude at DigiCert. These tweets are my own opinion and not the views of my employer. They also aren't very good tweets...unless you like PKI memes.

[Jeremy Rowley @GreatAmus]

@_robstr @sleevi_ @chosensecurity @hardenize @ivanristic @clintw_ @sleevi Are you throwing shade over your own bad data? It was just bad data, right?

[Jeremy Rowley @GreatAmus]

@vcsjones It's the best idea I could come up with address how you prevent pinning. Open to additional ideas of course, but it seemed like a straight forward way to address the concern.

[Jeremy Rowley @GreatAmus]

@mattiasgeniar @hanno Yep - already did on the bug. Both the revoked and not revoked are public. I haven't published the reasons for each certificate that was not revoked but I'm hoping to today. Most of them are because of lockdowns in areas with high covid concerns.

[Jeremy Rowley @GreatAmus]

@My1xT @Scott_Helme How could anyone be hostile to Josh?! Have you met the guy?!

[Jeremy Rowley @GreatAmus]

@zhenech @hanno @mattiasgeniar @Scott_Helme Hence we were trying to figure out what exceptional circumstances are and the extent of "certificate is used in critical infrastructure" means. In the end, the delay we allowed was for those who were impacted by Covid

[Jeremy Rowley @GreatAmus]

@zhenech @hanno @mattiasgeniar @Scott_Helme Well, we didn't expect an exception or extension. I think it's clear that there aren't any. Mozilla policy states "Mozilla recognizes that in some exceptional circumstances, revoking the affected certificates within the prescribed deadline may cause significant harm..."

[Jeremy Rowley @GreatAmus]

@hanno This one: https://t.co/wl2jeb4xnc

[Jeremy Rowley @GreatAmus]

@My1xT @Scott_Helme I doubt we would have considering internal policy and that the LE guys are all really cool people.

[Jeremy Rowley @GreatAmus]

@My1xT @Scott_Helme There's just over 5k where they couldn't be replaced because of COVID. Planning to post the full list of revoked vs. not revoked today (along with the reasons given for the delay). I filtered through the reasons and rejected a lot.

[Jeremy Rowley @GreatAmus]

@hanno The ICAs themselves aren't being revoked - just the EV under it (per the original bugzilla post). They're covered by BR audits so the remediation was to revoke all EV under them. I'll have to get back to you on the Secure Site one

[Jeremy Rowley @GreatAmus]

@hanno The original list included all ICAs not covered by the EV audit. However, a lot of them weren't actually issuing EV so there isn't an issue with them. There was confusion about this internally as well and unfortunately that confusion made it to the KB article.

[Jeremy Rowley @GreatAmus]

@tmslft @vcsjones I read it as we have a responsibility to educate cert purchasers about the potential impact of using web certs in non-web apps. However, I'm still trying to think of how to do this effectively other than through subscriber agreements. Still pondering it though.

[Jeremy Rowley @GreatAmus]

@davidmwhite @digicert @RedHat Thank you!

[Jeremy Rowley @GreatAmus]

@vcsjones It was fair. It's super confusing on what is going. There's a ton of weird information (and our posts didn't necessarily help that). Too tired. It's a lot of certs to reissue.

[Jeremy Rowley @GreatAmus]

@Scott_Helme @SeanWrightSec @UK_Daniel_Card It's not really harder. We have an ACME implementation with EV.

[Jeremy Rowley @GreatAmus]

@davidmwhite @digicert Revoking end entity certificates under the intermediate.

[Jeremy Rowley @GreatAmus]

@jedisct1 @Scott_Helme This isn't accurate. We were listing the reasons people are asking for delays. The only exceptional reason under the Mozilla policy is for delays resulting from covid interferring with the revocation.