<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Re-porting for Jürgen
<div class="moz-forward-container"><br>
Dimitris.</div>
<div class="moz-forward-container"><br>
<br>
-------- Forwarded Message --------
<table class="moz-email-headers-table" border="0" cellpadding="0"
cellspacing="0">
<tbody>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Subject:
</th>
<td>automation Re: [cabfpub] Draft Ballot 186 - Limiting the
Reuse of Validation Information</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Date: </th>
<td>Fri, 3 Feb 2017 17:59:58 +0100</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">From: </th>
<td>Jürgen Brauckmann <a class="moz-txt-link-rfc2396E" href="mailto:brauckmann@dfn-cert.de"><brauckmann@dfn-cert.de></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Organization:
</th>
<td>DFN-CERT Services GmbH</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">To: </th>
<td>CA/Browser Forum Public Discussion List
<a class="moz-txt-link-rfc2396E" href="mailto:questions@cabforum.org"><questions@cabforum.org></a>, Dimitris Zacharopoulos
<a class="moz-txt-link-rfc2396E" href="mailto:jimmy@it.auth.gr"><jimmy@it.auth.gr></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">CC: </th>
<td>Gervase Markham <a class="moz-txt-link-rfc2396E" href="mailto:gerv@mozilla.org"><gerv@mozilla.org></a></td>
</tr>
</tbody>
</table>
<br>
<br>
<pre>Gervase Markham via Public schrieb:
> Right. So my point is, we should be moving the ecosystem towards
> automation for certificate renewals.
[...]
> My view is that CAs would be serving their customers well if it were
> arranged that any customer could renew all of their certificates in a
> matter of hours if necessary.
Thats not necessarily only on the CAs. The hardest support cases are
certificates for fancy expensive boxes by Cisco et al (don't want to
particulary pick on Cisco, they are all the same in regards to
certificates). It hurts to install certificates on them, and nobody
likes to touch them because it creates operational risks.
Letsencrypt has done a really great job to show how automation works
with apache, nginx.
How is that automation supposed to spread to those fancy boxes?
The current discussions can lead to a situation where CAs and users are
squashed between browsers and vendors of those boxes. Maybe the vendors
move, maybe they don't.
Jürgen
[My be reposted to public list, thanks]
</pre>
</div>
</body>
</html>