To sign add-ons according to the plan[1] we need to pass in at least the add-on ID to Trunion so it can put that into the cert as part of the Common Name. After the signing is done, AMO needs to know the certificate serial number. We could pull this out of the returned add-on, or if Trunion is returning a blob to us anyway, we could put it in there. In short, we need to document what the ins and outs should look like. :) [1] https://docs.google.com/a/mozilla.com/document/d/1KhpDteoHFmVRkzlrT8v0N3F-KrPxLoZFM3mWmEmOses/edit

API defined here: https://wiki.mozilla.org/AMO/SigningService/API

is there more to do on this bug?

Nope. Should have been closed months ago.