<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Times New Roman" size="3"><a name="OLE_LINK71"></a><a name="OLE_LINK70"></a><a name="OLE_LINK69"></a><a name="OLE_LINK68"></a><a name="OLE_LINK59"></a><a name="OLE_LINK58"></a>
<div><font face="Calibri, sans-serif" size="2">Ben,</font></div>
<div><font face="Calibri, sans-serif" size="2"> </font></div>
<div><font face="Calibri, sans-serif" size="2">I originally mentioned on the Trans list, but it became clear that Trans was the wrong place to discuss implementation details like this. I hope you agree that this is an appropriate place for this discussion.</font></div>
<div><font face="Calibri, sans-serif" size="2"> </font></div>
<div><font face="Calibri, sans-serif" size="2">I’d like Google’s CT log servers to trust only those roots from which Symantec issues EV certs, for now. If CT gets expanded beyond EV, then we’ll add more roots. Removing these roots might allow us to detect the
incorrect issuance of an EV cert from a non-EV root, and it will prevent inappropriate certs (like code signing, timestamping, S/MIME, etc) from appearing in logs.</font></div>
<div><font face="Calibri, sans-serif" size="2"> </font></div>
<div><font face="Calibri, sans-serif" size="2">I’d like you to trust only those roots that are EV-enabled in Chrome. From <a href="https://code.google.com/p/chromium/codesearch#chromium/src/net/cert/ev_root_ca_metadata.cc&sq=package:chromium"><font color="#0000FF"><u>https://code.google.com/p/chromium/codesearch#chromium/src/net/cert/ev_root_ca_metadata.cc&sq=package:chromium</u></font></a>,
that means these roots:</font></div>
<div><font face="Calibri, sans-serif" size="2"> </font></div>
<div><font face="Calibri, sans-serif" size="2"> // Equifax Secure Certificate Authority (GeoTrust)</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0xd2, 0x32, 0x09, 0xad, 0x23, 0xd3, 0x14, 0x23, 0x21, 0x74,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0xe4, 0x0d, 0x7f, 0x9d, 0x62, 0x13, 0x97, 0x86, 0x63, 0x3a } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"1.3.6.1.4.1.14370.1.6", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> // GeoTrust Primary Certification Authority</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0x32, 0x3c, 0x11, 0x8e, 0x1b, 0xf7, 0xb8, 0xb6, 0x52, 0x54,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0xe2, 0xe2, 0x10, 0x0d, 0xd6, 0x02, 0x90, 0x37, 0xf0, 0x96 } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"1.3.6.1.4.1.14370.1.6", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> // GeoTrust Primary Certification Authority - G2</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0x8d, 0x17, 0x84, 0xd5, 0x37, 0xf3, 0x03, 0x7d, 0xec, 0x70,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0xfe, 0x57, 0x8b, 0x51, 0x9a, 0x99, 0xe6, 0x10, 0xd7, 0xb0 } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"1.3.6.1.4.1.14370.1.6", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> // GeoTrust Primary Certification Authority - G3</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0x03, 0x9e, 0xed, 0xb8, 0x0b, 0xe7, 0xa0, 0x3c, 0x69, 0x53,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0x89, 0x3b, 0x20, 0xd2, 0xd9, 0x32, 0x3a, 0x4c, 0x2a, 0xfd } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"1.3.6.1.4.1.14370.1.6", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> // Thawte Premium Server CA</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0x62, 0x7f, 0x8d, 0x78, 0x27, 0x65, 0x63, 0x99, 0xd2, 0x7d,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0x7f, 0x90, 0x44, 0xc9, 0xfe, 0xb3, 0xf3, 0x3e, 0xfa, 0x9a } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"2.16.840.1.113733.1.7.48.1", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> // thawte Primary Root CA</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0x91, 0xc6, 0xd6, 0xee, 0x3e, 0x8a, 0xc8, 0x63, 0x84, 0xe5,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0x48, 0xc2, 0x99, 0x29, 0x5c, 0x75, 0x6c, 0x81, 0x7b, 0x81 } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"2.16.840.1.113733.1.7.48.1", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> // thawte Primary Root CA - G2</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0xaa, 0xdb, 0xbc, 0x22, 0x23, 0x8f, 0xc4, 0x01, 0xa1, 0x27,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0xbb, 0x38, 0xdd, 0xf4, 0x1d, 0xdb, 0x08, 0x9e, 0xf0, 0x12 } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"2.16.840.1.113733.1.7.48.1", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> // thawte Primary Root CA - G3</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0xf1, 0x8b, 0x53, 0x8d, 0x1b, 0xe9, 0x03, 0xb6, 0xa6, 0xf0,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0x56, 0x43, 0x5b, 0x17, 0x15, 0x89, 0xca, 0xf3, 0x6b, 0xf2 } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"2.16.840.1.113733.1.7.48.1", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> // VeriSign Class 3 Public Primary Certification Authority</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0x74, 0x2c, 0x31, 0x92, 0xe6, 0x07, 0xe4, 0x24, 0xeb, 0x45,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0x49, 0x54, 0x2b, 0xe1, 0xbb, 0xc5, 0x3e, 0x61, 0x74, 0xe2 } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"2.16.840.1.113733.1.7.23.6", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> // VeriSign Class 3 Public Primary Certification Authority - G4</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0x22, 0xD5, 0xD8, 0xDF, 0x8F, 0x02, 0x31, 0xD1, 0x8D, 0xF7,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0x9D, 0xB7, 0xCF, 0x8A, 0x2D, 0x64, 0xC9, 0x3F, 0x6C, 0x3A } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"2.16.840.1.113733.1.7.23.6", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> // VeriSign Class 3 Public Primary Certification Authority - G5</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0x4e, 0xb6, 0xd5, 0x78, 0x49, 0x9b, 0x1c, 0xcf, 0x5f, 0x58,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0x1e, 0xad, 0x56, 0xbe, 0x3d, 0x9b, 0x67, 0x44, 0xa5, 0xe5 } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"2.16.840.1.113733.1.7.23.6", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> // VeriSign Universal Root Certification Authority</font></div>
<div><font face="Calibri, sans-serif" size="2"> { { { 0x36, 0x79, 0xca, 0x35, 0x66, 0x87, 0x72, 0x30, 0x4d, 0x30,</font></div>
<div><font face="Calibri, sans-serif" size="2"> 0xa5, 0xfb, 0x87, 0x3b, 0x0f, 0xa7, 0x7b, 0xb7, 0x0d, 0x54 } },</font></div>
<div><font face="Calibri, sans-serif" size="2"> {"2.16.840.1.113733.1.7.23.6", ""},</font></div>
<div><font face="Calibri, sans-serif" size="2"> },</font></div>
<div><font face="Calibri, sans-serif" size="2"> </font></div>
<div><font face="Calibri, sans-serif" size="2">Symantec would like you to remove these roots from your pilot and aviator log servers, since many have never been used to issue SSL certs at all:</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 2</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=GeoTrust Inc./CN=GeoTrust Universal CA</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=GeoTrust Inc./CN=GeoTrust Universal CA 2</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=Equifax Secure/OU=Equifax Secure eBusiness CA-2</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=Equifax Secure Inc./CN=Equifax Secure eBusiness CA-1</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=Equifax Secure Inc./CN=Equifax Secure Global eBusiness CA-1</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=VeriSign, Inc./OU=Class 1 Public Primary /C=US/O=VeriSign, Inc./OU=Class 1 Public Primary Certification Authority</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=VeriSign, Inc./OU=Class 1 Public Primary Certification Authority</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=VeriSign, Inc./OU=Class 2 Public Primary Certification Authority</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 2 CA/CN=TC TrustCenter Class 2 CA II</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 3 CA/CN=TC TrustCenter Class 3 CA II</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Class 4 CA/CN=TC TrustCenter Class 4 CA II</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Universal CA/CN=TC TrustCenter Universal CA I</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Universal CA/CN=TC TrustCenter Universal CA II</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=DE/O=TC TrustCenter GmbH/OU=TC TrustCenter Universal CA/CN=TC TrustCenter Universal CA III</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=ZA/ST=Western Cape/L=Durbanville/O=Thawte/OU=Thawte Certification/CN=Thawte Timestamping CA</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=VeriSign, Inc./OU=Class 1 Public Primary Certification Authority - G2/OU=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust Network</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=VeriSign, Inc./OU=Class 2 Public Primary Certification Authority - G2/OU=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust Network</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=VeriSign, Inc./OU=Class 3 Public Primary Certification Authority - G2/OU=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust Network</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=VeriSign, Inc./OU=Class 4 Public Primary Certification Authority - G2/OU=(c) 1998 VeriSign, Inc. - For authorized use only/OU=VeriSign Trust Network</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting cc/OU=Certification Services Division/CN=Thawte Server CA/emailAddress=server-certs@thawte.com</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 1999 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 1 Public Primary Certification Authority - G3</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 1999 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 2 Public Primary Certification Authority - G3</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 1999 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 3 Public Primary Certification Authority - G3</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=US/O=VeriSign, Inc./OU=VeriSign Trust Network/OU=(c) 1999 VeriSign, Inc. - For authorized use only/CN=VeriSign Class 4 Public Primary Certification Authority - G3</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting/OU=Certification Services Division/CN=Thawte Personal Basic CA/emailAddress=personal-basic@thawte.com</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting/OU=Certification Services Division/CN=Thawte Personal Premium CA/emailAddress=personal-premium@thawte.com</font></div>
<div><font face="Calibri, sans-serif" size="2">/C=ZA/ST=Western Cape/L=Cape Town/O=Thawte Consulting/OU=Certification Services Division/CN=Thawte Personal Freemail CA/emailAddress=personal-freemail@thawte.com</font></div>
<div><font face="Calibri, sans-serif" size="2"> </font></div>
<div><font face="Calibri, sans-serif" size="2">I can provide you with the certs themselves if that would make it easier for you.</font></div>
<div><font face="Calibri, sans-serif" size="2"> </font></div>
<div><font face="Calibri, sans-serif" size="2">Thanks,</font></div>
<div><font face="Calibri, sans-serif" size="2"> </font></div>
<div><font face="Calibri, sans-serif" size="2">-Rick</font></div>
<div><font face="Calibri, sans-serif" size="2"><br>
</font></div>
<div><font face="Calibri, sans-serif" size="2"> </font></div>
<div><font face="Calibri, sans-serif" size="2"> </font></div>
</font>
</body>
</html>