<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">The SHA1 deprecation policy is not intended to apply to roots distributed outside the Windows root cert program.
</span><span style="color:#1F497D">This policy does not affect certificates that chain up to privately deployed root CAs. Administrators will have the option to enable the no SHA1 policy from Group Policy.</span><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Doug Beattie [mailto:doug.beattie@globalsign.com]
<br>
<b>Sent:</b> Wednesday, January 22, 2014 3:30 PM<br>
<b>To:</b> Tom Albertson<br>
<b>Cc:</b> 'CABFPub'<br>
<b>Subject:</b> RE: [cabfpub] Guidance on Microsoft SHA1 Deprecation Policy<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Thanks Tom.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">I’m sorry to keep asking follow up questions, but I assume this applies to Roots that are not distributed within the MS program as well. Just wanted to confirm that private root customers (including large government
PKIs) also need to comply, not just the public CAs and their publicly trusted roots.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Doug<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Tom Albertson [<a href="mailto:tomalb@microsoft.com">mailto:tomalb@microsoft.com</a>]
<br>
<b>Sent:</b> Wednesday, January 22, 2014 5:29 PM<br>
<b>To:</b> Doug Beattie; CABFPub<br>
<b>Subject:</b> RE: [cabfpub] Guidance on Microsoft SHA1 Deprecation Policy<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi Doug,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span lang="EN">The SHA1 deprecation </span>policy states that
<span lang="EN">Windows Vista and later will stop accepting SHA1 end-entity certificates by the deadlines given. This</span> will apply to all certificates issued under the root hierarchy including SSL, secure email, client authentication, and code signing.
We expect all certificate types excluding code signing and time stamping to follow the SSL deprecation schedule.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Tom<span style="color:#1F497D"><o:p></o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Doug Beattie<br>
<b>Sent:</b> Wednesday, January 22, 2014 8:42 AM<br>
<b>To:</b> CABFPub<br>
<b>Subject:</b> [cabfpub] Guidance on Microsoft SHA1 Deprecation Policy<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The Microsoft policy is located here, as I’m sure you all know:<o:p></o:p></p>
<p class="MsoNormal"><a href="http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx">http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The policy clearly states the scope of this policy is for SSL and Code Signing, but I wanted to validate that this is in-fact the entire set of users which will be impacted in 2017.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">While not clear in the blog, in side discussions it became evident that that all CAs in the hierarchy of an SSL or Code Signing certificate (except the root) must also be SHA2. This makes sense even if not explicitly stated (it should
be stated at some point). This means legacy SHA1 Intermediates cannot be used to sign subordinate SHA2 CAs and be trusted in 2017 for SSL and Code Signing certificates.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I wanted for inquire about personal certificates used for secure mail, client authentication to web sites (including Microsoft web servers), document signing (outside of Adobe), file encryption, etc. Will SHA1 certificates and CA hierarchies
continue to be trusted by Microsoft within these applications, or is Microsoft rolling out new validation logic globally for all certificates?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Doug<o:p></o:p></p>
</div>
</body>
</html>