<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">Over on the mozilla.dev.security.policy list, there was some confusion about which subordinate CAs need to have audits.<div class=""><br class=""></div><div class="">I’ve put together two flow charts to help document what I think has been said on that list. I tried to merge info from both the Mozilla and Microsoft policies, so I might be a little off.</div><div class=""><br class=""></div><div class="">The one place where this does differ from current Mozilla policy is that it has disclosure of technically constrained CA certificates themselves. This is proposed for Mozilla but not yet required.</div><div class=""><br class=""></div><div class="">Anyone see errors?</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Peter</div><div class=""><br class=""></div><div class=""><img apple-inline="yes" id="B3D198D9-52DC-4752-BA05-DEC3CBE05E02" src="cid:1448EA88-FA5D-42A1-834B-7D9771EF668F@amazon.com" class=""></div><div class=""><br class=""></div><div class=""><img apple-inline="yes" id="0C5DE404-5CF4-4DB0-BE03-951701DE893B" src="cid:02E8C038-8D30-4D75-B553-7FB965C30FF6@amazon.com" class=""></div></body></html>