<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 3, 2017, at 12:59 PM, Ryan Sleevi via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Mon, Apr 3, 2017 at 3:57 PM, Steve Medin <span dir="ltr" class=""><<a href="mailto:Steve_Medin@symantec.com" target="_blank" class="">Steve_Medin@symantec.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple" class=""><div class="m_2894408288949050887WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d" class="">On April 22, nearly one third of the authentication databases of all certificate authorities is invalidated. All data currently held from work done between 825 days and 39 months ago is wiped from use when it could have been consumed until March 1 if 193 was written as Chris seems to have intended.</span></p></div></div></blockquote><div class=""><br class=""></div><div class="">But that doesn't matter unless someone applies for a certificate.</div><div class=""><br class=""></div><div class="">You don't need to reissue all of those certificates. Only ones which are expired and/or need to be reissued.</div><div class=""><br class=""></div><div class="">This exact same problem would occur on March 1, 2018. Literally everything else in your message still applies, so please help me understand what makes this different at all.</div></div></div></div></div></blockquote><br class=""></div><div>Ryan,</div><div><br class=""></div><div>This “exact same problem” will only occur on March 1, 2018 if CAs do not change anything. If they quickly change their customer messaging and systems to day that validations are only good for 825 days starting very soon, then when March 1, 2018 rolls around there will be few (if any) validations that would have been valid under the current rule but are not valid under the new rule.</div><div><br class=""></div><div>Thanks,</div><div>Peter</div></body></html>