<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>
<!--
@font-face
{font-family:Wingdings}
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
@font-face
{font-family:Tahoma}
@font-face
{font-family:Consolas}
@font-face
{font-family:"Bradley Hand ITC"}
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif"}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline}
p
{margin-right:0in;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif"}
pre
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New"}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif"}
span.EmailStyle19
{font-family:"Calibri","sans-serif";
color:windowtext}
span.HTMLPreformattedChar
{font-family:Consolas}
span.EmailStyle22
{font-family:"Calibri","sans-serif";
color:#1F497D}
.MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.WordSection1
{}
ol
{margin-bottom:0in}
ul
{margin-bottom:0in}
-->
</style>
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">Can we clarify if the date checks apply only to the end-entity certificates? Or do they also apply to the intermediates? If the latter, that would require new SHA-1 intermediates to be issued with 2015-12-31
expiration dates in order to offer option #1 to customers.</span><span style="color:black"></span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<div>
<div style="border:none; border-top:solid #B5C4DF 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt; font-family:"Tahoma","sans-serif""> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>kirk_hall@trendmicro.com<br>
<b>Sent:</b> Friday, August 22, 2014 12:15 PM<br>
<b>To:</b> CABFPub (public@cabforum.org)<br>
<b>Subject:</b> [cabfpub] New Google policy on SHA-1 deprecation next 6-112 weeks</span></p>
</div>
</div>
<p class="MsoNormal"> </p>
<p class="MsoNormal">For those CA/Browser Forum members who were not on the Forum conference call yesterday, I wanted to forward information that Google disclosed during the call that will affect all CAs.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Google has announced a policy to deprecate many SHA-1 certificates and some SHA-256 certificated currently in use
<u>in the next 6-12 weeks</u> (upon the release of Chrome version 39):</p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal"><a href="https://groups.google.com/a/chromium.org/d/msg/security-dev/2-R4XziFc7A/NDI8cOwMGRQJ" target="_blank">https://groups.google.com/a/chromium.org/d/msg/security-dev/2-R4XziFc7A/NDI8cOwMGRQJ</a></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal">Here is how we understand this.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal">Starting with Chrome 39, in about 12 weeks (mid-November), when Chrome encounters an SSL certificate that is SHA-1, or a SHA-256 certificate with a SHA-1 intermediate in the chain, the user will see a deprecated security UI. Specifically:</p>
<p class="MsoNormal"> </p>
<p style="margin-right:0in; margin-bottom:0in; margin-left:.5in; margin-bottom:.0001pt; text-indent:-.25in">
<span style="font-size:11.0pt; font-family:Symbol"><span style="">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"">If the SSL cert expires after 1/1/2016 but before 2017, then the user will see a padlock with a red line though it (and no green bar for EV certificates) and the page will
be served up as normal with no user action.</span></p>
<p style="margin-right:0in; margin-bottom:0in; margin-left:.5in; margin-bottom:.0001pt; text-indent:-.25in">
<span style="font-size:11.0pt; font-family:Symbol"><span style="">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"">If the SSL certificate expires after 1/1/2017, then the user will see the padlock with a red line through it, AND the page will be treated as mixed content and the user
will need to perform an action to proceed.</span></p>
<p style="margin-right:0in; margin-bottom:0in; margin-left:.5in; margin-bottom:.0001pt; text-indent:-.25in">
<span style="font-size:11.0pt; font-family:Symbol"><span style="">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"">Again, this will affect all SHA-1 certificates and all SHA-256 certificates issued from a SHA-1 intermediate certificate, no matter when such certificates were issued or
deployed.</span></p>
<p style="margin-right:0in; margin-bottom:0in; margin-left:.5in; margin-bottom:.0001pt; text-indent:-.25in">
<span style="font-size:11.0pt; font-family:Symbol"><span style="">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><span style="font-size:11.0pt; font-family:"Calibri","sans-serif"">Per Google, SHA-1 roots can still be used, but all certificates in the chain must be SHA-256 to avoid the negative UI.</span></p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoNormal">Google has told CAs that their affected customers have two choices over the next 6-12 weeks to avoid the negative UIs for their websites.</p>
<p class="MsoNormal"><span style="color:#1F497D"> </span></p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-family:Symbol"><span style="">·<span style="font:7.0pt "Times New Roman"">
</span></span></span>Customers can replace their SHA-1 certs that expire in 2016 or 2017 with new SHA-1 certs that expire no later than 12/31/2015 (same for new SHA-256 certs issued from a SHA-1 intermediate), and they will get the regular UI trust symbols
in Chrome, or</p>
<p class="MsoListParagraph" style="text-indent:-.25in"><span style="font-family:Symbol"><span style="">·<span style="font:7.0pt "Times New Roman"">
</span></span></span>Customers can replace their SHA-1 certs (or SHA-256 certs issued from a SHA-1 intermediate) with SHA-256 certs issued from SHA-256 intermediates, which can expire in 2016 or 2017 and will receive the regular UI trust symbols in Chrome.</p>
<p class="MsoNormal"> </p>
<p class="MsoNormal"><b><i><span style="font-size:14.0pt; font-family:"Bradley Hand ITC"; color:#0F243E">Kirk R. Hall</span></i></b></p>
<p class="MsoNormal">Operations Director, Trust Services</p>
<p class="MsoNormal">Trend Micro</p>
<p class="MsoNormal">+1.503.753.3088</p>
<p class="MsoNormal"> </p>
<table class="MsoNormalTable" border="0" cellpadding="0">
<tbody>
<tr>
<td style="background:white; padding:.75pt .75pt .75pt .75pt">
<table class="MsoNormalTable" border="0" cellpadding="0">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt">
<pre> </pre>
<pre>TREND MICRO EMAIL NOTICE</pre>
<pre>The information contained in this email and any attachments is confidential </pre>
<pre>and may be subject to copyright or other intellectual property protection. </pre>
<pre>If you are not the intended recipient, you are not authorized to use or </pre>
<pre>disclose this information, and we request that you notify us by reply mail or</pre>
<pre>telephone and delete the original message from your mail system.</pre>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="font-size:12.0pt; font-family:"Times New Roman","serif""> </span></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information
contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.<br>
</font>
</body>
</html>