On Wed, Nov 14, 2018 at 9:47 AM Vincent Lynch <[email protected]> wrote:
> Was looking for some quick clarification on interpretation of this bit: > > *"All certificates containing an underscore character in any dNSName entry > and having a validity period of more than 30 days MUST be revoked prior to > January 15, 2019."* > > This language refers to the TOTAL validity period of the certificate, not > the REMAINING validity, correct? > > Correct. So, for example, a certificate with a NotBefore: 2/1/18 and NotAfter: > 1/30/19 would have to be revoked? > Yes. Only certificates with a TOTAL validity of <30 days (example, NotBefore: > 12/20/18, NotAfter: 1/19/19) would be allowed to naturally expire? > > Yes. The thinking here is that many organizations don't pay attention to certificate sunsets (e.g. sha-1) until it affects them directly. By requiring them to replace their certificates while still allowing some time to transition away from them via 30-day duration certificates, the hope is that we will avoid the urgent calls for exceptions we've seen with past sunset periods. Thanks, > > Vincent > > On Mon, Nov 12, 2018 at 4:19 PM Wayne Thayer via dev-security-policy < > [email protected]> wrote: > >> As you may be aware, the CA/Browser Forum recently passed ballot SC12 [1] >> creating a sunset period for TLS certificates containing an underscore >> ("_") character in the SAN. This practice was widespread until a year ago >> when it was pointed out that underscore characters are not permitted in >> dNSName name forms, and ballot 202 was proposed to create an exception to >> RFC 5280 that would allow the practice to continue. When that ballot >> failed, some CAs stopped allowing underscore characters in SANs and others >> continued. Ballot SC12 is intended to resolve this inconsistency and >> provide clear guidance to auditors. >> >> The sunset period defined by ballot SC12 is very short. Today Mozilla sent >> an email to all CAs in our program informing them of this change and >> asking >> them to take any steps necessary to comply [2]. >> >> - Wayne >> >> [1] >> >> https://cabforum.org/2018/11/12/ballot-sc-12-sunset-of-underscores-in-dnsnames/ >> [2] >> >> https://wiki.mozilla.org/CA/Communications#November_2018_CA_Communication_.28Underscores_in_dNSNames.29 >> _______________________________________________ >> dev-security-policy mailing list >> [email protected] >> https://lists.mozilla.org/listinfo/dev-security-policy >> > > > -- > Vincent Lynch > _______________________________________________ dev-security-policy mailing list [email protected] https://lists.mozilla.org/listinfo/dev-security-policy
