Re: Policy Update Discussion: Third-Party SubCAs

2011-04-28 Thread Wan-Teh Chang
On Thu, Apr 28, 2011 at 4:50 AM, Jean-Marc Desperrier wrote: > > BTW isn't there somewhere a page with the corespondance between NSS and > Firefox version ? I believe there is one, but can't find it again. The page is http://www.mozilla.org/projects/security/pki/nss/mozilla-nss-versions.html. I

Re: Policy Update Discussion: Third-Party SubCAs

2011-04-28 Thread Jean-Marc Desperrier
Robert Relyea wrote: One interesting historical note is the final solution was based on a suggestion of one Jean-Marc Desperrier;). Well, when rereading that bug to check it all, I mistakenly thought that NSS 3.9 was the first version with libpkix and that the change only applied to libpkix.

Re: Policy Update Discussion: Third-Party SubCAs

2011-04-27 Thread Robert Relyea
On 04/27/2011 06:42 AM, Jean-Marc Desperrier wrote: > Jean-Marc Desperrier wrote: >> Johan Sys wrote: >>> [...] >>> We did some tests with name constraints with positive results: >>> SubCA with name constraint as follows : >>> Permitted >>> [1]Subtrees (0..Max): >>> DNS Name=.goodcompany.globalsign

Re: Policy Update Discussion: Third-Party SubCAs

2011-04-27 Thread Wan-Teh Chang
On Wed, Apr 27, 2011 at 6:42 AM, Jean-Marc Desperrier wrote: > Jean-Marc Desperrier wrote: >> >> Johan Sys wrote: >>> >>> [...] >>> We did some tests with name constraints with positive results: >>> SubCA with name constraint as follows : >>> Permitted >>> [1]Subtrees (0..Max): >>> DNS Name=.goodc

Re: Policy Update Discussion: Third-Party SubCAs

2011-04-27 Thread Jean-Marc Desperrier
Jean-Marc Desperrier wrote: Johan Sys wrote: [...] We did some tests with name constraints with positive results: SubCA with name constraint as follows : Permitted [1]Subtrees (0..Max): DNS Name=.goodcompany.globalsign Excluded=None Issued cert www.goodcompany.globalsign passes. Anything else i