On Tuesday 14 October 2008 08:03:04 Nelson B Bolyard wrote: > Some time ago, in the last year, while the details of EV were getting > worked out, I read a message from a representative of a CA whose root(s) > are in Firefox. He wrote that to resolve certain issues with some browsers > using new roots and other browsers using old roots, his CA was advising > customers to configure their servers to send out all the certs needed to > build a chain to either of those roots.
Hi Nelson. I think you're probably referring to me and Comodo's EV AUTO-Enhancer(tm)... https://bugzilla.mozilla.org/show_bug.cgi?id=406755#c33 > If I recall correctly, he used the word "shotgun" to describe this > technique. I didn't use that word. > Sadly for me, I do not remember who wrote that comment, or what CA he > represented, or to which mailing list he sent that message, and I cannot > find that message. So now I'm writing to this group in hopes that that > person reads this list. > > If you are the CA representative who wrote about that, please write to > me and tell me if there is any public information about your technique. See the bugzilla.mozilla.org link above. > I write this because the IETF TLS working group is now considering whether > to refine the next TLS RFC to speak to certain related issues. It has been > proposed to change the text in the next TLS RFC to explicitly disallow the > sending of anything but a single cert chain, from leaf to root. Nelson, thanks for mentioning this! I really do hope that this proposed change is not approved! I've been meaning to get around to suggesting to the IETF TLS WG that the next TLS RFC should *explicitly allow* the sending of certs in multiple chains! > I'd like to offer pointers to any public information about that "shotgun" > technique as evidence that the alternative (sending certs that are NOT > necessarily a single chain) is being used to good advantage on the Internet > today. The bugzilla.mozilla.org link above mentions a number of good advantages w.r.t. activating the EV UI in Internet Explorer 7. I'd be more than happy to answer any further questions. > Regards, > /Nelson > _______________________________________________ > dev-tech-crypto mailing list > dev-tech-crypto@lists.mozilla.org > https://lists.mozilla.org/listinfo/dev-tech-crypto -- Rob Stradling Senior Research & Development Scientist Comodo - Creating Trust Online Office Tel: +44.(0)1274.730505 Fax Europe: +44.(0)1274.730909 www.comodo.com Comodo CA Limited, Registered in England No. 04058690 Registered Office: 3rd Floor, 26 Office Village, Exchange Quay, Trafford Road, Salford, Manchester M5 3EQ This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender by replying to the e-mail containing this attachment. Replies to this email may be monitored by Comodo for operational or business reasons. Whilst every endeavour is taken to ensure that e-mails are free from viruses, no liability can be accepted and the recipient is requested to use their own virus checking software. _______________________________________________ dev-tech-crypto mailing list dev-tech-crypto@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-tech-crypto
