Re: Dynamic Path Resolution in AIA CA Issuers

2014-07-30 Thread Ondrej Mikle
On 07/31/2014 01:17 AM, Ondrej Mikle wrote: > On 07/30/2014 09:17 PM, Kathleen Wilson wrote: [...] >> So, Should we do this? >> Does it introduce security concerns? > > It definitely introduces non-deterministic behavior controlled by a potential > MitM attacker, in addition being hard to debug.

Re: Dynamic Path Resolution in AIA CA Issuers

2014-07-30 Thread Ondrej Mikle
On 07/30/2014 09:17 PM, Kathleen Wilson wrote: > On 7/28/14, 11:00 AM, Brian Smith wrote: >> I suggest that, instead of including the cross-signing certificates in >> the NSS certificate database, the mozilla::pkix code should be changed >> to look up those certificates when attempting to find them

Re: Dynamic Path Resolution in AIA CA Issuers

2014-07-30 Thread David E. Ross
On 7/30/2014 12:17 PM, Kathleen Wilson wrote: > On 7/28/14, 11:00 AM, Brian Smith wrote: >> I suggest that, instead of including the cross-signing certificates in >> the NSS certificate database, the mozilla::pkix code should be changed >> to look up those certificates when attempting to find them

RE: Proposal: Advocate to get Section 9.3.1 (Reserved Certificate Policy Identifiers) made mandatory.

2014-07-30 Thread Jeremy Rowley
Per our CPS and the BR/EV requirements, we always abide by the latest version of the BRs >From Section 8.3: " [Name of CA] conforms to the current version of the CA/Browser Forum Guidelines for Issuance and Management of Extended Validation Certificates published at http://www.cabforum.org. In

Re: Removal of 1024 bit CA roots - interoperability

2014-07-30 Thread Brian Smith
On Mon, Jul 28, 2014 at 12:05 PM, Kai Engert wrote: > On Mon, 2014-07-28 at 21:02 +0200, Kai Engert wrote: >> On Mon, 2014-07-28 at 11:00 -0700, Brian Smith wrote: >> > I suggest that, instead of including the cross-signing certificates in >> > the NSS certificate database, the mozilla::pkix code

RE: GlobalSign Request to Include ECC Roots

2014-07-30 Thread Jeremy Rowley
I do not think specifying a version number is required. All CAs issuing EV certs (or SSL) are required to abide by the latest version of the guidelines and attest to that fact in their CPS using the prescribed CAB Forum language: "[Name of CA] conforms to the current version of the CA/Browser

Re: Dynamic Path Resolution in AIA CA Issuers

2014-07-30 Thread Matt Palmer
On Wed, Jul 30, 2014 at 12:17:27PM -0700, Kathleen Wilson wrote: > On 7/28/14, 11:00 AM, Brian Smith wrote: > >I suggest that, instead of including the cross-signing certificates in > >the NSS certificate database, the mozilla::pkix code should be changed > >to look up those certificates when attem

Re: Dynamic Path Resolution in AIA CA Issuers

2014-07-30 Thread Brian Smith
On Wed, Jul 30, 2014 at 12:17 PM, Kathleen Wilson wrote: > On 7/28/14, 11:00 AM, Brian Smith wrote: >> >> I suggest that, instead of including the cross-signing certificates in >> the NSS certificate database, the mozilla::pkix code should be changed >> to look up those certificates when attemptin

Dynamic Path Resolution in AIA CA Issuers

2014-07-30 Thread Kathleen Wilson
On 7/28/14, 11:00 AM, Brian Smith wrote: I suggest that, instead of including the cross-signing certificates in the NSS certificate database, the mozilla::pkix code should be changed to look up those certificates when attempting to find them through NSS fails. That way, Firefox and other products

Re: GlobalSign Request to Include ECC Roots

2014-07-30 Thread Matt Palmer
OK, let's dive into the CPS dissection game... On Tue, Jul 29, 2014 at 03:26:08PM -0700, Kathleen Wilson wrote: > ** CPS section 3.2.2.3, Extended Validation Certificates (SSL and > Code Signing): For Extended Validation Certificates, the EV > Guidelines are followed. I'm new to this, so perhaps