<p dir="ltr">Hi Kirk,</p>
<p dir="ltr">I feel like I have sufficiently explained our concerns and motivations throughout this thread, with both you and other CAs, that it should be readily apparent that this neither meets our goals nor helps our users.</p>
<p dir="ltr">I appreciate your thoughtful consideration in writing it.</p>
<p dir="ltr">Best,<br>
Ryan</p>
<div class="gmail_quote">On Aug 28, 2014 7:04 PM, "<a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a>" <<a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Ryan and Chris – here is a serious proposal for a modified Google SHA-1 policy. It meets all of your stated goals. Please give it some consideration.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">1. SHA-1 certs issued on or after [Nov. 1, 2014] that expire on or after January 1, 2017 get a double whammy bad UI in Google upon issuance – red
slash and nasty click-throughs. (This will stop issuance of 2017 SHA-1 certs this fall.)<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">2. SHA-1 certs issued before [Nov. 1, 2014] that expire on or after January 1, 2017 get a double whammy bad UI in Google starting [March 1, 2015]
– red slash only and nasty click-throughs. (This will force existing websites with 2017 SHA-1 certs to change them within the next six months).<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Result: All 2017 SHA-1 certs will be gone by next March 2015 – which certainly meets your goals. Customers with existing 2017 certs can get through
this holiday season, CAs can get the message out. <u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Advantages:<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">1. CAs that have never issued 2017 certs, and never will (like Trend Micro) and their customers are not affected – that’s appropriate, as we have
never been a part of this problem.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">2. CAs that have issued three year SHA-1 certs expiring in 2017 will stop by this fall.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">3. CAs that have issued 2017 certs in the past (and their customers) will be affected, but will have six months to adjust. That will be a much
smaller number of customers affected than if those with 2016 certs are forced to change their certs twice (in 2014 and again in 2015).<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">4. All SHA-1 certs will likely be gone by next spring.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">I don’t think Google should spend much time worrying about how CAs communicate with their customers about the need to move to SHA-256 before 2017 – that’s for us to worry
about, and we are all strongly incentivized to get the message out (selling a 2017 cert that doesn’t work creates legal problems, and none of us wants to be dealing with angry SHA-1 customers in late 2016 who have to switch to SHA-256). We may also be able
to get behind Google’s policy if it is revised – something that isn’t the case today.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">You mentioned somewhere that you worried that simply deprecating SHA-1 certs as of 2017 could create a big customer service burden on Google as of late 2016 or early 2017.
I don’t think that’s the case with this new proposed policy, as all the negative UI effects will happen in 2014-15. Plus, I predict Google will be deluged with customer service complaints under your current policy, when thousands of websites start showing
as “untrusted” in the next 6-12 weeks. Why not make life easier for Google with a revised policy?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">So what do you think? Can we make a change to the policy that is focused on the real problem (2017 certs)?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Thanks for your consideration.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><b><i><span style="font-size:14.0pt;font-family:"Bradley Hand ITC";color:#0f243e">Kirk R. Hall<u></u><u></u></span></i></b></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Operations Director, Trust Services<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Trend Micro<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
<table><tr><td bgcolor="#ffffff"><font color="#000000"><pre><table><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table></blockquote></div>