Re: Custom TLS Extensions in NSS (Patch in Progress)

2013-08-14 Thread Daniel Jackoway
On Aug 14, 2013, at 5:39 PM, Robert Relyea wrote: > Are you adding the extensions programmatically (that is an application can > add extensions by making various calls to do so) or are you adding extensions > dynamically through some sort of configuration. Both are useful, though the > latter

Re: Custom TLS Extensions in NSS (Patch in Progress)

2013-08-14 Thread Robert Relyea
On 08/14/2013 10:45 AM, Daniel Jackoway wrote: Hi all, With the guidance of Trevor Perrin (cc-ed), I have put together the beginnings of a patch to allow clients of the NSS library to implement support for arbitrary TLS extensions. The motivation is to allow clients of NSS to implement new pr

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-08-14 Thread Robert Relyea
On 08/09/2013 10:12 AM, Brian Smith wrote: On Fri, Aug 9, 2013 at 3:27 AM, Gervase Markham wrote: * Can you provide some background or references on exactly how ciphersuite construction and choice works? Can I invent e.g. TLS_DHE_ECDSA_WITH_AES_128_MD5 or some other random combination of eleme

Re: Fwd: RE: [cabfpub] Ballot 108: Clarifying the scope of the baseline requirements

2013-08-14 Thread Robert Relyea
On 08/09/2013 02:57 AM, Gervase Markham wrote: Can an NSS hacker please tell me, in the fashion of the attempt by the IE representative below, what types of certificate NSS accepts for making SSL connections? What features must the cert or chain have or not have? Or, if this is a PSM question, t

Re: moznss with openldap - error -8018:Unknown PKCS #11 error

2013-08-14 Thread Robert Relyea
On 08/07/2013 10:38 PM, Augustin Wolf wrote: Hi List, I have a Centos 6.4, fresh install, and I'm trying to configure OpenLDAP with moznss. For now, self signed certificate is sufficient for my needs. But when I try to search using secure connection (-Z option), I got error: ldap_start_tls: Conn

Custom TLS Extensions in NSS (Patch in Progress)

2013-08-14 Thread Daniel Jackoway
Hi all, With the guidance of Trevor Perrin (cc-ed), I have put together the beginnings of a patch to allow clients of the NSS library to implement support for arbitrary TLS extensions. The motivation is to allow clients of NSS to implement new proposals that bolster the CA trust model, such as