Hi
We're already having some discussions about SHA-1, but I'll split this
up into a new thread.
The initial goal of bug 942515 was to mark certs as insecure, that are
valid 'notBefore >= 2016-01-01' (means issued to use in 2016+) AND also
for certs that are valid 'notAfter >= 2017-1-1' (means still valid in
2017+).
The first condition has been implemented, but there are some
'compatibility' issues with MITM software. [1]
The second condition has not been implemented, but it was already
announced [2] and also considered to set the cut-off a half year earlier
to the July 1, 2016. If this should really happen, we need to hurry up
on this discussion. Of course the problem mentioned in [1] should be
solved first.
Regards,
Jonas
[1]
https://blog.mozilla.org/security/2016/01/06/man-in-the-middle-interfering-with-increased-security/
[2]
https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/
[3]
https://blog.mozilla.org/security/2015/10/20/continuing-to-phase-out-sha-1-certificates/
signature.asc
Description: OpenPGP digital signature
--
dev-tech-crypto mailing list
dev-tech-crypto@lists.mozilla.org
https://lists.mozilla.org/listinfo/dev-tech-crypto
