<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Bradley Hand ITC";
panose-1:3 7 4 2 5 3 2 3 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#222222;background:white">[This is reposted from the Google SHA-1 list]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#222222;background:white"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#222222;background:white">Ryan, I asked a question yesterday, and am still interested in the answer. Why not push out the implementation of Google's new policy by six months – in other words, delay the negative UI effect
on SHA-1 certs expiring after 2015 until six months from now? <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#222222;background:white"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#222222;background:white">You can see that most or all CAs think Google’s current 6-12 week deadline is way too short for many website owners to change out all their current (valid) SHA-1 certs, especially with the holiday
season lock-down coming soon (the window for response is actually more like 4 weeks for some retail websites).</span><o:p></o:p></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline"><span style="color:#222222"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline"><span style="color:#222222">Google can accomplish 100% of its stated goals with a six month delay in enforcement (e.g., to March 1, 2015). This new date would still require all websites
to replace all SHA-1 certs by the end of 2015 – Google’s stated goal – but in a more reasonable time frame.<o:p></o:p></span></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline"><span style="color:#222222"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline"><span style="color:#222222">Your prior postings have indicated Google has been working on this new policy for six months (February to August, when the new policy was announced). Why not
give website owners and CAs an equal period of time – six months – to respond to the new policy if that new deadline will still achieve all of your goals? That could make your policy much more successful, and would be appreciated by everyone.<o:p></o:p></span></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline"><span style="color:#222222"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white;vertical-align:baseline"><span style="color:#222222">**So how about it, Ryan – will Google help everyone out and postpone its new policy for six months?**</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><i><span style="font-size:14.0pt;font-family:"Bradley Hand ITC";color:#0F243E">Kirk R. Hall<o:p></o:p></span></i></b></p>
<p class="MsoNormal">Operations Director, Trust Services<o:p></o:p></p>
<p class="MsoNormal">Trend Micro<o:p></o:p></p>
<p class="MsoNormal">+1.503.753.3088<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>