Fwd: RE: [cabfpub] Ballot 108: Clarifying the scope of the baseline requirements

2013-08-09 Thread Gervase Markham
Can an NSS hacker please tell me, in the fashion of the attempt by the IE representative below, what types of certificate NSS accepts for making SSL connections? What features must the cert or chain have or not have? Or, if this is a PSM question, tell me that :-) Gerv Original Message

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-08-09 Thread Gervase Markham
Hi Brian, On 09/08/13 03:30, Brian Smith wrote: Please see https://briansmith.org/browser-ciphersuites-01.html Suggestions for improvements are encouraged. Thanks for this. Here are my questions: * Can you provide some background or references on exactly how ciphersuite construction

moznss with openldap - error -8018:Unknown PKCS #11 error

2013-08-09 Thread Augustin Wolf
Hi List, I have a Centos 6.4, fresh install, and I'm trying to configure OpenLDAP with moznss. For now, self signed certificate is sufficient for my needs. But when I try to search using secure connection (-Z option), I got error: ldap_start_tls: Connect error (-11) additional info: TLS

Re: downloading NSS

2013-08-09 Thread Kai Engert
On Wed, 2013-08-07 at 17:12 +, James Burton wrote: Hi, I would like to know were i could download Netscape Security Library which Mozilla NSS was build on. This page attempts to collect a small selection of links to get you started: http://nss-crypto.org/ However, the official project

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-08-09 Thread Brian Smith
On Fri, Aug 9, 2013 at 3:27 AM, Gervase Markham g...@mozilla.org wrote: * Can you provide some background or references on exactly how ciphersuite construction and choice works? Can I invent e.g. TLS_DHE_ECDSA_WITH_AES_128_MD5 or some other random combination of elements? Can any combination

Re: Proposal to Change the Default TLS Ciphersuites Offered by Browsers

2013-08-09 Thread Tom Ritter
Thoughts, as a random passerby: Of course I quite like the prioritization of (EC)DHE. I think standardizing on a ciphersuite preference order with the aims of reducing fingerprinting is a worthwhile (although wildly difficult) goal for SSL _libraries_, but less so for browsers - to the point of