Add Apple IST CA 8 to the Symantec exclusion, remove CA3 - G1 and NTT

Add Apple IST CA 8 to the Symantec exclusion, remove CA3 - G1 and NTT

Symantec originally indicated NTT DoCoMo was indepedently operated,
but subsequent investigation revealed it was part of Symantec's MPKI.
Apple's G3 is only audited to WebTrust for CAs, not SSL BRs, so removing
it from the exclusion set.

This adds Apple's CA 8 to the set, after communicating with Apple's PKI
team to receive confirmation that it was created pursuant to the
audited CP/CPS and is part of the same infrastructure.

BUG=620178
Committed: https://crrev.com/ad93be59f39a73f36fdf6d329b48892a08c3fc36
Cr-Commit-Position: refs/heads/master@{#407618}

[Ryan Sleevi, 2016-07-25 19:36:02]

rsleevi@chromium.org changed reviewers:
+ eroman@chromium.org

[Ryan Sleevi, 2016-07-25 19:36:02]

I... previously forgot to re-run the script after removing CA3 & NTT DoCoMo,
hence the removals while updating this...

[Ryan Sleevi, 2016-07-25 19:36:15]

On 2016/07/25 19:36:02, Ryan Sleevi (extremely slow) wrote:
> I... previously forgot to re-run the script after removing CA3 & NTT DoCoMo,
> hence the removals while updating this...

script = what's documented in README.md

[eroman, 2016-07-25 20:00:38]

> Add Apple IST CA 8 to the Symantec exclusion, remove CA3 - G1 and NTT

The CL description refers to 1 addition and 2 removals.
However the code appears to have 3 removals and 1 addition.
What is the discrepancy?

Also why are there no corresponding removal of PEM files in this change?

[Ryan Sleevi, 2016-07-25 20:29:45]

On 2016/07/25 20:00:38, eroman wrote:
> > Add Apple IST CA 8 to the Symantec exclusion, remove CA3 - G1 and NTT
> 
> The CL description refers to 1 addition and 2 removals.
> However the code appears to have 3 removals and 1 addition.
> What is the discrepancy?

NTT DoCoMo had 2 roots being removed, but I only referred to the org.

> Also why are there no corresponding removal of PEM files in this change?

These were the files I mentioned I removed (before checking in) but forgot to
re-run the script.

[eroman, 2016-07-25 21:40:07]

lgtm

[Ryan Sleevi, 2016-07-25 21:40:42]

The CQ bit was checked by rsleevi@chromium.org

[commit-bot: I haz the power, 2016-07-25 21:41:03]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-07-25 22:45:59]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-07-25 22:47:45]

Description was changed from

==========
Add Apple IST CA 8 to the Symantec exclusion, remove CA3 - G1 and NTT

Symantec originally indicated NTT DoCoMo was indepedently operated,
but subsequent investigation revealed it was part of Symantec's MPKI.
Apple's G3 is only audited to WebTrust for CAs, not SSL BRs, so removing
it from the exclusion set.

This adds Apple's CA 8 to the set, after communicating with Apple's PKI
team to receive confirmation that it was created pursuant to the
audited CP/CPS and is part of the same infrastructure.

BUG=620178
==========

to

==========
Add Apple IST CA 8 to the Symantec exclusion, remove CA3 - G1 and NTT

Symantec originally indicated NTT DoCoMo was indepedently operated,
but subsequent investigation revealed it was part of Symantec's MPKI.
Apple's G3 is only audited to WebTrust for CAs, not SSL BRs, so removing
it from the exclusion set.

This adds Apple's CA 8 to the set, after communicating with Apple's PKI
team to receive confirmation that it was created pursuant to the
audited CP/CPS and is part of the same infrastructure.

BUG=620178

Committed: https://crrev.com/ad93be59f39a73f36fdf6d329b48892a08c3fc36
Cr-Commit-Position: refs/heads/master@{#407618}
==========

[commit-bot: I haz the power, 2016-07-25 22:47:46]

Patchset 1 (id:??) landed as
https://crrev.com/ad93be59f39a73f36fdf6d329b48892a08c3fc36
Cr-Commit-Position: refs/heads/master@{#407618}