<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body dir="auto">
<div></div>
<div>That wasn't quite accurate I realized. They aren't necessarily embedding the root but they are relying on browser access to the device, meaning each of these devices are essentially the same as servers, requiring public trust.</div>
<div><br>
On Oct 5, 2017, at 1:44 PM, Jeremy Rowley via Public <<a href="mailto:public@cabforum.org">public@cabforum.org</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div></div>
<div>Yes. Check out plex and our other mass issuance customers (I'm not sure I can provide names on a public list despite these being discoverable). These aren't short lived...yet.</div>
<div><br>
On Oct 5, 2017, at 1:37 PM, Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a>> wrote:<br>
<br>
</div>
<blockquote type="cite">
<div>
<div dir="ltr">Jeremy,
<div><br>
</div>
<div>Could you supply data to support your claim that "internet connected devices increasingly use trusted roots for connecting to smartphones"?</div>
<div><br>
</div>
<div>
<div class="gmail_extra">
<div class="gmail_quote">On Wed, Oct 4, 2017 at 8:21 PM, Jeremy Rowley via Public
<span dir="ltr"><<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_-7845583694068447653WordSection1">
<p class="MsoNormal">Pre-signing OCSP responses for these certs is a waste of time as they’ll expire before the OCSP is ever delivered.
</p>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Delivered to who? Are you saying you deliver certificates before you've produced OSP responses?</div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_-7845583694068447653WordSection1">
<p class="MsoNormal">When you are signing certs daily, even signing that first OCSP response eats up lots of processing power without providing any benefit to the user. Removing OCSP for short-lived certs eliminates an external call to the CA
</p>
</div>
</div>
</blockquote>
<div><br>
</div>
<div>Stapling</div>
<div> </div>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_-7845583694068447653WordSection1">
<p class="MsoNormal">and makes the certificate smaller, both essential in device performance. Plus, Mozilla already supports not checking revocation for these certs, meaning the revocation info is completely useless in at least one browser.
<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Any takers on supporting this?<span class="HOEnZb"><font color="#888888"><u></u><u></u></font></span></p>
<span class="HOEnZb"><font color="#888888">
<p class="MsoNormal"><br>
</p>
</font></span></div>
</div>
</blockquote>
<div><br>
</div>
<div>Do you have any new data to suggest clock skew isn't a significant issue, and that such certificates would represent compatibility problems for the ecosystem if deployed? Is the assumption that it's the sites and users' fault/responsibility, despite the
overall ecosystem widespread use could cause?</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</blockquote>
<blockquote type="cite">
<div><span>_______________________________________________</span><br>
<span>Public mailing list</span><br>
<span><a href="mailto:Public@cabforum.org">Public@cabforum.org</a></span><br>
<span><a href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a></span><br>
</div>
</blockquote>
</body>
</html>