[cabfpub] Ballot 111 - Accelerate Max Certificate Lifetime Reduction Timetable

[kirk_hall at trendmicro.com]

Well, so far the existence of 60 month certs has not stopped the browsers from imposing new requirements on CAs and certificates that have an immediate effect on all certs (60 month and 39 month certs alike) – some browsers have even taken the position that new rules in the BRs adopted in July 2012 and made effective in February 2013 would apply *retroactively* to certs issued *before* those dates.

So I don’t really think it’s true that the existence of 60 month certs issued by some CAs has ever limited changes made by the Forum, or their effective dates.  Has it?

From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org] On Behalf Of Eddy Nigg (StartCom Ltd.)
Sent: Thursday, November 28, 2013 3:22 PM
To: CABFPub
Subject: Re: [cabfpub] Ballot 111 - Accelerate Max Certificate Lifetime Reduction Timetable


On 11/28/2013 10:53 PM, From kirk_hall at trendmicro.com:<mailto:kirk_hall at trendmicro.com:>
Are there any known security breaches from past-issued 60 month certs (such as someone stealing the private key plus using the cert beyond a 39 month expiration period, someone selling an old server that had a private key plus 60-month cert on it, change of corporate identity during a five-year period that rendered a properly-issued 60-month cert inaccurate, but the cert was still used, etc.)?  Or is the concern more theoretical?

Kirk, if you read the responses from Bruce and Dean (and maybe some others) you understand that every time a change needs to be introduced you'll get opposition from exactly those CAs that issue long-living certificates. We all understand that CAs want to nail a customer for as long as possible and make a difference by issuing certificates for long periods of time (irresponsible) because others won't do that - but since this requirement would be applied across the board I believe there will be no competitive disadvantage to any of them.

However the entire industry will improve once changes can be pushed through within ~ 3 years than currently 5 and previously 10. Being able to act faster and get rid of possible problematic certificates within the time-frame of 3 years without the need of revocation (which would result in a another outcry anyway) is probably a worthy goal. With the current upcoming changes it appears to be a golden opportunity to achieve that.

Regards



Signer:

Eddy Nigg, COO/CTO



StartCom Ltd.<http://www.startcom.org>

XMPP:

startcom at startcom.org<xmpp:startcom at startcom.org>

Blog:

Join the Revolution!<http://blog.startcom.org>

Twitter:

Follow Me<http://twitter.com/eddy_nigg>





<table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential 
and may be subject to copyright or other intellectual property protection. 
If you are not the intended recipient, you are not authorized to use or 
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20131129/81db261b/attachment-0003.html>