<html><div><br>
-----Original message-----<br>
<b>From:</b>Ryan Sleevi via Public<public@cabforum.org><br>
<b>To:</b>Geoff Keating<geoffk@apple.com><br>
<b>Cc:</b>Ryan Sleevi<sleevi@google.com>,CA/Browser Forum Public Discussion List<public@cabforum.org><br>
<b>Date: </b> Sat, 04 Feb 2017 09:37:51<br>
<b>Subject:</b> Re: [cabfpub] Draft Ballot 185 - Limiting the Lifetime of Certificates<br>
<div dir="ltr"><br>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Feb 3, 2017 at 4:35 PM, Geoff Keating <span dir="ltr"><<a href="mailto:geoffk@apple.com" target="_blank">geoffk@apple.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;">Weren’t most of the long-lived certificates that caused problems those issued before the current limit of ~3 years? </blockquote><div><br>
</div><div>Nope, not in our experience. I'm hoping Jody can share his graph, but much of our 'breakage' experience was from sites where the CA waited to stop issuing SHA-1 certs until it was explicitly forbidden - that is, they did not even default to SHA-256, or made it considerably *more* difficult for their customers to obtain SHA-256 signed certs</div><div><br>
</div><div><font color="#0000ff">===></font></div><div><font color="#0000ff">Ryan, You said you hope Jody can share his graph. Do you mean the discussion in last Fall Redmond F2F meeting as the minute below in Mozilla's news section?</font></div><div><a href="https://cabforum.org/2016/10/19/2016-10-19-20-f2f-meeting-39-minutes/#Mozilla"><font color="#0000ff">https://cabforum.org/2016/10/19/2016-10-19-20-f2f-meeting-39-minutes/#Mozilla</font></a></div><div><font color="#0000ff"><br>
</font></div><div><font color="#0000ff">Side note based on comments from Microsoft<br>
•MS shows 20M sites with SHA-1 where as FF counts traffic<br>
•Why do this now vs. waiting a year, that’s the rush?<br>
•Wants to work with other browsers on timing. Google might have different pain thresholds. Goal is to figure out we get proper user feedback and that stakeholders are not screaming.</font></div><div><br>
</div><div><br>
</div><div>The no-SHA-1 requirement came in force January 2016 - not 2015. We passed the Ballot in 2015, following Microsoft's announced deprecation in Nov 12, 2013 - <a href="https://technet.microsoft.com/en-us/library/security/2880823.aspx">https://technet.microsoft.com/en-us/library/security/2880823.aspx</a></div><div><br>
</div><div><font color="#0000ff">==></font></div><div><font color="#0000ff">The SHA-1 sunset ballot was passed on 16 October 2014, not 2015. </font></div><div><font color="#0000ff">Please see </font></div><div><a href="https://cabforum.org/2014/10/16/ballot-118-sha-1-sunset/"><font color="#0000ff">https://cabforum.org/2014/10/16/ballot-118-sha-1-sunset/</font></a><font color="#0000ff"> </font></div><div><font color="#0000ff"><br>
</font></div><div><font color="#0000ff">I think most CAs offer their cusomers to migrate SHA-1 SSL certificates to SHA 256 SSL certificates for free. Try their best to call out and e-mail to the customers to encourage them. </font></div><div><font color="#0000ff"><br>
</font></div><div><font color="#0000ff">Sincerely Yours,</font></div><div><font color="#0000ff"><br>
</font></div><div><font color="#0000ff"> Li-Chun Chen</font></div><div><font color="#0000ff"> Chunghwa Telecom Co. Ltd.</font></div><div><br>
</div><div><br>
</div><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-color: rgb(204, 204, 204); border-left-width: 1px; border-left-style: solid;"><br>
</blockquote></div></div></div>
_______________________________________________<br>
Public mailing list<br>
Public@cabforum.org<br>
<a href="https://cabforum.org/mailman/listinfo/public" target="new_win">https://cabforum.org/mailman/listinfo/public</a><br>
<br>
</div></html><br><html><div><div>本信件可能包含中華電信股份有限公司機密資訊,非指定之收件者,請勿蒐集、處理或利用本信件內容,並請銷毀此信件. 如為指定收件者,應確實保護郵件中本公司之營業機密及個人資料,不得任意傳佈或揭露,並應自行確認本郵件之附檔與超連結之安全性,以共同善盡資訊安全與個資保護責任. </div><div>Please be advised that this email message (including any attachments) contains confidential information and may be legally privileged. If you are not the intended recipient, please destroy this message and all attachments from your system and do not further collect, process, or use them. Chunghwa Telecom and all its subsidiaries and associated companies shall not be liable for the improper or incomplete transmission of the information contained in this email nor for any delay in its receipt or damage to your system. If you are the intended recipient, please protect the confidential and/or personal information contained in this email with due care. Any unauthorized use, disclosure or distribution of this message in whole or in part is strictly prohibited. Also, please self-inspect attachments and hyperlinks contained in this email to ensure the information security and to protect personal information.</div></div><div><br></div><div><br></div></html>