<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:v =
"urn:schemas-microsoft-com:vml" xmlns:o =
"urn:schemas-microsoft-com:office:office" xmlns:w =
"urn:schemas-microsoft-com:office:word" xmlns:m =
"http://schemas.microsoft.com/office/2004/12/omml"><HEAD>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<META name=Generator content="Microsoft Word 14 (filtered medium)">
<STYLE><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></STYLE>
</HEAD>
<BODY lang=EN-US dir=ltr link=blue vLink=purple>
<DIV dir=ltr>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: 'Calibri'; COLOR: #000000">
<DIV>Yes, to get a 24 hour validity time you need a minimum window of 24+24+24 =
72 hours. So the certs are valid for 48 hours at issue, postdated 24 hours (plus
the start of the previous day in my current code).</DIV>
<DIV> </DIV>
<DIV>The spec is completely neutral as far as validity time is concerned.</DIV>
<DIV> </DIV>
<DIV>I will do whatever is necessary on the draft tomorrow..</DIV>
<DIV> </DIV>
<DIV> </DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV style="FONT: 10pt tahoma">
<DIV style="font-color: black"><B>From:</B> <A title=jeremy.rowley@digicert.com
href="mailto:jeremy.rowley@digicert.com">Jeremy Rowley</A> </DIV>
<DIV><B>Sent:</B> Monday, June 02, 2014 4:17 PM</DIV>
<DIV><B>To:</B> <A title=philliph@comodo.com
href="mailto:philliph@comodo.com">'Phillip Hallam-Baker'</A> ; <A
title=public@cabforum.org href="mailto:public@cabforum.org">'CABFPub'</A> </DIV>
<DIV><B>Subject:</B> RE: [cabfpub] Revocation and Certificate
Issue</DIV></DIV></DIV></DIV>
<DIV
style="BORDER-TOP-COLOR: #000000; BORDER-BOTTOM-COLOR: #000000; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 4px solid; BORDER-RIGHT-COLOR: #000000">
<DIV
style='FONT-SIZE: small; TEXT-DECORATION: none; FONT-FAMILY: "Calibri"; FONT-WEIGHT: normal; COLOR: #000000; FONT-STYLE: normal; DISPLAY: inline'>
<DIV class=WordSection1>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'>Hi
Phillip, <o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'><o:p></o:p></SPAN> </P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'>I
think 72 hours is a better validity period for short-lived certs. Looking
at this before, the clock skew was still problematic at 48 hours. Also,
one of the obstacles in promoting short-lived certs is the lack of benefit to
the server operator and CA in creating these (under the current BRs). CAs
are still required to publish OCSP information and browsers will still check for
revocatio</SPAN><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'>n
(or not) regardless of the certificate validity Unless there is a better
benefit, you won’t likely see much support. That said, I’m still in favor
of short lived certs and will happily review and provide
input.<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'><o:p></o:p></SPAN> </P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'>Also,
I submitted a request to IANA for the must staple OID. They responded
saying I need your approval before the approval is complete. They also
said we’d need to update your draft to include a section on IANA
considerations. I’m happy to help with pushing this along, I just need an
email from you approving of OID request. <o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'><o:p></o:p></SPAN> </P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'>Thanks!<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'><o:p></o:p></SPAN> </P>
<P class=MsoNormal><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'>Jeremy
<o:p></o:p></SPAN></P>
<P class=MsoNormal><A name=_MailEndCompose><SPAN
style='FONT-SIZE: 11pt; FONT-FAMILY: "Calibri","sans-serif"; COLOR: #1f497d'><o:p></o:p></SPAN></A> </P>
<DIV>
<DIV
style="BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; BORDER-BOTTOM: medium none; PADDING-BOTTOM: 0in; PADDING-TOP: 3pt; PADDING-LEFT: 0in; BORDER-LEFT: medium none; PADDING-RIGHT: 0in">
<P class=MsoNormal><B><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"'>From:</SPAN></B><SPAN
style='FONT-SIZE: 10pt; FONT-FAMILY: "Tahoma","sans-serif"'>
public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <B>On Behalf Of
</B>Phillip Hallam-Baker<BR><B>Sent:</B> Monday, June 2, 2014 12:59
PM<BR><B>To:</B> CABFPub<BR><B>Subject:</B> [cabfpub] Revocation and Certificate
Issue<o:p></o:p></SPAN></P></DIV></DIV>
<P class=MsoNormal><o:p></o:p> </P>
<DIV>
<DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>All,<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>Getting back to the
problem of certificate issue I see the following options on the
table:<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>1) CRL
Sets<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>2) OCSP stapling +
must stapled<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>3) Short lived
certificates (48 hour validity)<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>Of these, only 1 and 2
are feasible with current technology and (1) does not solve the problem as far
as CAs are concerned (and I don’t want to talk about that subject right now).
And even if they did work the revocation set still scales in proportion to total
certificates issued and so its not a long term
solution.<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>[BTW: Yes, I have
pinged on the Must staple draft request again over the weekend though if someone
else wants to take over the chasing thing then maybe they are better at getting
results than me.]<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>I also note that (2)
has the same imposition on the server as a short lived cert. After all, an OCSP
token is kindof like a short lived cert. Which means that in my view any long
term solution to revocation has to be based on short lived certs for end entity
certificates plus a CRLSet for the intermediate certs (which is not a scaling
issue as they should never be revoked in normal
circumstances).<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>And so I have been
looking at the impediments to deployment of short lived certs. And the main one
is that certificate admin is just too much of a hassle at the moment. And so I
wrote this draft:<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'><A
title=http://tools.ietf.org/html/draft-hallambaker-omnipublish-00
href="http://tools.ietf.org/html/draft-hallambaker-omnipublish-00">http://tools.ietf.org/html/draft-hallambaker-omnipublish-00</A><o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>I am looking for
supporters, reviewers etc. <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>The draft is a simple
JSON-REST based service for establishing a network service. This
means<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>1) Acquiring the
necessary credentials<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>2) Requesting
necessary firewall configuration, DNS config etc.<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>I have combined these
two functions for several reasons. One is that if the PKIX world was to suggest
a new enrollment process that was not DANE friendly right now there would be
fightin’ words and a counter proposal. The other is that it just makes total
sense to wrap everything up into one service.<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>The approach described
greatly simplifies the whole process of applying for a certificate IF THE SPEC
IS SUPPORTED BY THE SERVER. Lets face it, I can write a plug in that makes it
really easy to apply for certs from Apache but the pain of installing the plug
in and running Apache with it is going to be much greater than the pain of
applying for a cert.<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>As with all my recent
work, it builds on the SXS-Connect protocol which is simply a mechanism that
allows me to bind the end-entity to use the certificate to the service supplying
it.<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'><A
title=http://tools.ietf.org/html/draft-hallambaker-wsconnect-08
href="http://tools.ietf.org/html/draft-hallambaker-wsconnect-08">http://tools.ietf.org/html/draft-hallambaker-wsconnect-08</A><o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>At the moment the spec
only describes use for applying for a PKIX cert using a CSR and I have only
tried it for TLS and S/MIME. But it would work equally well for other cert
request formats and other types of cert. SAML assertions for example. I think it
would work for PGP as well.<o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'>The description is
centered on the most common SOHO small business applying for cert use case but
the scheme is certainly applicable to more complicated schemes with firewalls,
in-house local RAs etc. <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV>
<DIV>
<P class=MsoNormal><SPAN
style='FONT-FAMILY: "Calibri","sans-serif"; COLOR: black'> <o:p></o:p></SPAN></P></DIV></DIV></DIV></DIV></DIV></DIV></DIV></DIV></BODY></HTML>