Re: [openssl-users] Re: How to disable index and serial?

2011-01-13 Thread Mark H. Wood
Ah. I did not understand that referenced by browser vendors meant we were talking about inclusion in their canned trust stores. Thanks, both of you. -- Mark H. Wood, Lead System Programmer mw...@iupui.edu Asking whether markets are efficient is like asking whether people are smart.

Re: [openssl-users] Re: How to disable index and serial?

2011-01-12 Thread Mark H. Wood
On Tue, Jan 11, 2011 at 07:23:54PM +0100, Erwann ABALEA wrote: In order to be referenced by browser vendors (Opera comes to mind, and I think Mozilla will require this), the serial number MUST be random (or at least *appear* random from the outside). Oh, now I'm curious. How do they test the

Re: [openssl-users] Re: How to disable index and serial?

2011-01-12 Thread Erwann ABALEA
Hodie pr. Id. Ian. MMXI, Mark H. Wood scripsit: On Tue, Jan 11, 2011 at 07:23:54PM +0100, Erwann ABALEA wrote: In order to be referenced by browser vendors (Opera comes to mind, and I think Mozilla will require this), the serial number MUST be random (or at least *appear* random from the

Re: [openssl-users] Re: How to disable index and serial?

2011-01-12 Thread David Schwartz
On 1/12/2011 6:48 AM, Mark H. Wood wrote: Oh, now I'm curious. How do they test the randomness of a single sample? 1 is every bit as random (or nonrandom) as 0xdcb4a459f014617692d112f0942c89cb. They don't validate the number itself, they validatet hat the method by which the number was

Re: [openssl-users] Re: How to disable index and serial?

2011-01-11 Thread Erwann ABALEA
Hodie III Id. Ian. MMXI, Peter Sylvester scripsit: by using the command x509 and not ca for example. you can use a serial number based on a date seconds plus processid for example) to guarantee uniqueness. More on this. A serial number MUST be unique (by X.509 design), and SHOULD be random