True - short lived certs are typically not EV certs, but, as pointed out, the eventual plan is for all certs. We might as well make it uniform now.
Anyone use a short-lived cert must be able to easily replace existing certificates. That, combined with the relatively low number of certificates, minimalizes the risk of a site going dark because of a compromised log. Jeremy From: public-boun...@cabforum.org [mailto:public-boun...@cabforum.org] On Behalf Of michal.proszkiew...@unizeto.pl Sent: Wednesday, February 05, 2014 9:20 AM To: a...@chromium.org Cc: therightkey@ietf.org; public-boun...@cabforum.org; certificate-transpare...@googlegroups.com; pub...@cabforum.org Subject: Re: [cabfpub] Updated Certificate Transparency + Extended Validation plan If we are talking about EV certificates then probably there are not many that are valid for a 1 month. It may be the case for other types of certificates. For example CERTUM issue trusted test SSL certificates valid for 30 days (standard DV verification procedures and DV certificate profile). >From the other hand we give our customer possibility to manually shorten validity period to one day if they like (for every certificate type). -Michał Adam Langley <a...@chromium.org> Wysłane przez: public-boun...@cabforum.org 2014-02-05 16:40 Do certificate-transparency <certificate-transpare...@googlegroups.com> DW "therightkey@ietf.org" <therightkey@ietf.org>, CABFPub <pub...@cabforum.org> Temat Re: [cabfpub] Updated Certificate Transparency + Extended Validation plan On Wed, Feb 5, 2014 at 10:26 AM, Rob Stradling <rob.stradl...@comodo.com> wrote: > Also, what happened to the idea of only requiring 1 SCT for a 1-month cert? I'm to blame for that. Certificates with a single SCT put a lower bound on how quickly we can distrust a log (at least without special measures, such as shipping the whole, public log hashes to all the clients, which is probably impractical.) Since I'm not aware of any CAs issuing one month certs, and it only saves ~100 bytes vs 2 SCTs, it seemed to be something that should be dropped. Cheers AGL _______________________________________________ Public mailing list pub...@cabforum.org <https://cabforum.org/mailman/listinfo/public> https://cabforum.org/mailman/listinfo/public
_______________________________________________ therightkey mailing list therightkey@ietf.org https://www.ietf.org/mailman/listinfo/therightkey
