<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Thanks Stephen. Is that documented anywhere? While I recall reading a lot about deprecated UIs for SHA-1 certs, I don’t remember anything about the “identity validated” piece being different. If that’s the case, it’s extremely misleading to end users who have no idea nor are expected to know what SHA1 even is.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Dean<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Stephen Davidson [mailto:S.Davidson@quovadisglobal.com] <br><b>Sent:</b> Saturday, January 24, 2015 2:09 PM<br><b>To:</b> Ben Wilson; Dean Coclin; CABFPub (public@cabforum.org)<br><b>Subject:</b> RE: Chrome security warning discrepancy?<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>In Chrome all valid SSL normally have “identity verified”. The difference is that DV and OV show the URL, while EV shows the Subject O.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>I think Chrome is showing “identity not verified” for SHA1-based certs with validity into 2016. <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Regards, Stephen<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Ben Wilson<br><b>Sent:</b> Saturday, January 24, 2015 2:58 PM<br><b>To:</b> Dean Coclin; CABFPub (<a href="mailto:public@cabforum.org">public@cabforum.org</a>)<br><b>Subject:</b> Re: [cabfpub] Chrome security warning discrepancy?<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>Dean wrote, “Does anybody understand this?”<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>My response – “no”.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Dean Coclin<br><b>Sent:</b> Saturday, January 24, 2015 9:55 AM<br><b>To:</b> CABFPub (<a href="mailto:public@cabforum.org">public@cabforum.org</a>)<br><b>Subject:</b> [cabfpub] Chrome security warning discrepancy?<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I recently downloaded the newest version of Chrome (Version 40.0.2214.91 m) and am now baffled by the certificate information. Here are 2 examples:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This screen shot shows <a href="https://www.Marriott.com">https://www.Marriott.com</a>. First it shows the green lock and https as a normal indication of a secure connection. But below it says the site is using outdated security settings. I thought if it said this, then we would see a yellow indication (triangle or question mark) above. Have things changed?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Further, it says “Identity not verified” even though the site has undergone OV vetting and all information in the cert about the company was checked.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><img border=0 width=364 height=604 id="Picture_x0020_1" src="cid:image001.png@01D03958.9969FDF0"><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Contrast this to the 2<sup>nd</sup> site below, <a href="https://www.carbon2cobalt.com/statuslogin.asp">https://www.carbon2cobalt.com/statuslogin.asp</a> which has a DV cert yet says “Identity verified”:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><img border=0 width=316 height=546 id="Picture_x0020_3" src="cid:image002.png@01D03958.9969FDF0"><o:p></o:p></p><p class=MsoNormal>Both sites have had their domain names “validated” yet why say “Identity verified” with a DV cert and not an OV cert?<o:p></o:p></p><p class=MsoNormal>Does anybody understand this?<br><br>Thanks,<br>Dean<o:p></o:p></p></div></body></html>