Fwd: Hi, I have three questions about embed bank CA cert in Firefox

2010-07-21 Thread Amax Guan
Thank you very much, it's very helpful. I put most of the replies inline. On Wed, Jul 21, 2010 at 8:30 AM, Gervase Markham g...@mozilla.org wrote: On 20/07/10 04:23, Amax Guan wrote: I've got a problem help China Construction Bank(CCB for short) support Firefox. CCB has its own CA root,

Re: JSS in Firefox - loading applets over mutual SSL stopped working since the v. 3.6.x

2010-07-21 Thread Nelson B Bolyard
On 2010-07-20 02:21 PDT, Waldek wrote: Hi again, is there anybody who's been able to get such a setup working after upgrading to FF 3.6.x ?? Is it a FF 3.6.x bug ?? Could someone from Mozilla guys state anything in this case ?? I've no other ideas so far but recommending my customers

Re: Fwd: Hi, I have three questions about embed bank CA cert in Firefox

2010-07-21 Thread Anders Rundgren
On 2010-07-21 16:26, Amax Guan wrote: Thank you very much, it's very helpful. I put most of the replies inline. On Wed, Jul 21, 2010 at 8:30 AM, Gervase Markham g...@mozilla.org mailto:g...@mozilla.org wrote: On 20/07/10 04:23, Amax Guan wrote: I've got a problem help

Unsubscribe

2010-07-21 Thread samrat saha
Unsubscribe On Wednesday, July 21, 2010, Anders Rundgren anders.rundg...@telia.com wrote: On 2010-07-21 16:26, Amax Guan wrote: Thank you very much, it's very helpful. I put most of the replies inline. On Wed, Jul 21, 2010 at 8:30 AM, Gervase Markham g...@mozilla.org

Re: Fwd: Hi, I have three questions about embed bank CA cert in Firefox

2010-07-21 Thread Amax Guan
Hi Anders Thanks for your information. Do you know where I can download a windows binary of certutil.exe? On Wed, Jul 21, 2010 at 11:32 PM, Anders Rundgren anders.rundg...@telia.com wrote: On 2010-07-21 16:26, Amax Guan wrote: Thank you very much, it's very helpful. I put most of the

Re: Fwd: Hi, I have three questions about embed bank CA cert in Firefox

2010-07-21 Thread Anders Rundgren
On 2010-07-21 17:57, Amax Guan wrote: Hi Anders Thanks for your information. Do you know where I can download a windows binary of certutil.exe? Hi Amax, Try this SDK which is supposed to contain certutil.exe as well:

Re: Fwd: Hi, I have three questions about embed bank CA cert in Firefox

2010-07-21 Thread Waldek
Hi, The server using their own CA is in the certificate generation process, I wonder is it related to two-way SSL or something? If they use the web based solution to enroll certificates from CA, which is quite widely used, then why not to distribute the CA public certificate by the same page

Re: Fwd: Hi, I have three questions about embed bank CA cert in Firefox

2010-07-21 Thread Gervase Markham
On 21/07/10 07:26, Amax Guan wrote: I think basically it's because they have too much Cert to issue (One for each user), it cost too much money, and they do not want anyone else to know how many users they have, and their names, including the CA. Right. I am not suggesting that they get client

RE: Fwd: Hi, I have three questions about embed bank CA cert in Firefox

2010-07-21 Thread Ryan Sleevi
-Original Message- From: dev-tech-crypto-bounces+ryan- mozdevtechcrypto=sleevi@lists.mozilla.org [mailto:dev-tech-crypto- bounces+ryan-mozdevtechcrypto=sleevi@lists.mozilla.org] On Behalf Of Gervase Markham Sent: Wednesday, July 21, 2010 1:22 PM To:

Re: Fwd: Hi, I have three questions about embed bank CA cert in Firefox

2010-07-21 Thread Nelson B Bolyard
On 2010-07-21 10:50 PDT, Ryan Sleevi wrote, quoting Gervase Markham: On 21/07/10 07:26, Amax Guan wrote: But if you generate a user Certificate that's issued by a untrusted CA, there will be an alert popup. Can some NSS or PSM hacker explain why this is? Gerv While neither an NSS nor PSM

Re: Passing random numbers between tokens - what FIPS thinks ?

2010-07-21 Thread Nelson B Bolyard
I wrote: FIPS 140 will not allow *any* hardware pure noise source to be used by itself as a random number/bit source. Instead, such a source MUST be fed into a DRBG from which any internal random data is taken. To clarify, by pure noise source, I meant such as a forward biased silicon PN

Re: Passing random numbers between tokens - what FIPS thinks ?

2010-07-21 Thread Nelson B Bolyard
On 2010-07-19 03:18 PDT, Konstantin Andreev wrote: Let assume, I have high-quality, conformant to all relevant standards (e.g. FIPS 140-1), hardware, true random numbers source - token B. Token vendor intimately cares about standard API to the token, and provides PKCS#11 library. Indeed,

RE: Question for CA representatives about PKCS#10 CSRs you accept

2010-07-21 Thread Varga Viktor
At us, none of them used. We are dropping the ATTRIBUTES, the content of certificate relies on the defined certificate profile. Üdvözlettel/Regards, Varga Viktor Üzemeltetési és Vevőszolgálati Vezető IT Service and Customers Service Executive Netlock Kft. -Original Message- From:

Re: Question for CA representatives about PKCS#10 CSRs you accept

2010-07-21 Thread aerowolf
I can tell you that Eddy Nigg's (Startcom) system drops all ATTRIBUTE requests, relying on the CSR simply as a means of knowing what the public key is and proof of possession of the private key. and believe me, it'd be much easier if it didn't. -Kyle H On Thu, Jun 17, 2010 at 11:45 AM,

Re: Fwd: Hi, I have three questions about embed bank CA cert in Firefox

2010-07-21 Thread Amax Guan
Hi Anders Thank you very much, this really help alot:) We won't let end-users use that tool, instead, we put it in a installer, and let the installer do the dirty work. btw, Since this certutil.exe is downloaded from microsoft.com, I'm a little worried about whether this certutil.exe is