Re: SHA-1 roots, OCSP, CRLs and the transition away from SHA-1

2014-11-06 Thread Gervase Markham
I think you may have buried the lede a little bit here, Rick :-) The questions are: * Does NSS correctly handle the case where a SHA-1 root signs a SHA-2 CRL or OCSP response? * Which version of Firefox first supported SHA-2? I believe the answer to the first question is Yes; NSS doesn't

Re: Announcing Mozilla::PKIX, a New Certificate Verification Library

2014-11-06 Thread crodenberg
On Thursday, October 16, 2014 3:04:59 PM UTC-5, treb...@gmail.com wrote: On Monday, April 7, 2014 6:33:50 PM UTC-4, Kathleen Wilson wrote: All, We have been working on a new certificate verification library for Gecko, and would greatly appreciate it if you will test this new

Re: Announcing Mozilla::PKIX, a New Certificate Verification Library

2014-11-06 Thread Richard Barnes
On Nov 5, 2014, at 3:43 PM, crodenb...@gmail.com wrote: On Thursday, October 16, 2014 3:04:59 PM UTC-5, treb...@gmail.com wrote: On Monday, April 7, 2014 6:33:50 PM UTC-4, Kathleen Wilson wrote: All, We have been working on a new certificate verification library for Gecko, and

Re: NSS modutil: Adding PKCS#11 module with PIN to nssdb

2014-11-06 Thread Robert Relyea
On 11/06/2014 03:12 PM, Mike Gerow wrote: Apologies if a dupe of this shows up. I had posted my last question without _properly_ subscribing to list and so it is stuck in some kind of moderator queue. I'm trying to add the opencryptoki PKCS#11 module to Chrome/Firefox's nssdb, and it seems to

Re: NSS modutil: Adding PKCS#11 module with PIN to nssdb

2014-11-06 Thread Robert Relyea
On 11/06/2014 04:08 PM, Mike Gerow wrote: Thanks for the quick reply! I can see how caching the PIN would have its issues, but I'm not interested in having NSS ask for the PIN once and save it, but in configuring it to just use a provided PIN in the first place. Still has the same issue, if you