[cabfpub] [TRANS] CA survey - CT Precertificate format in6962-bis

Rob Stradling rob.stradling at comodo.com
Fri Oct 3 12:06:14 MST 2014


On 03/10/14 17:21, Rich Smith wrote:
>
>
>> -----Original Message-----
>> From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org]
>> On Behalf Of Stephen Davidson
>>
> <snip>
>    it goes live in 89 days.
> </snip>
> [RWS] Unless Ballot 134 fails to pass.  IF that happens, the CAs which issue
> EV certificates will have a choice to make.  Either issue pre-certificates
> with the same serial number in contravention of the EV Guidelines to comply
> with Google's policy, and thereby risk failing their WebTrust or ETSI
> compliance audit, OR not issue pre-certificates with the same serial number,
> remain in compliance with the EV Guidelines, and let Google deal with the
> site operators whose compliant EV certificates no longer work in Chrome.

OR issue Precertificates, taking the view that Precertificates are out 
of scope for the BRs.

OR issue Precertificates, taking the view that Precertificates are in 
scope for the BRs, but that duplicate serial numbers don't violate the 
BRs (because the BRs don't actually incorporate RFC5280 Section 4.1.2.2 
currently).

Plenty of options.

>> Best regards, Stephen
>>
>>
>>
>> -----Original Message-----
>> From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org]
>> On Behalf Of Rob Stradling
>> Sent: Thursday, October 02, 2014 5:36 PM
>> To: public at cabforum.org
>> Subject: [cabfpub] [TRANS] CA survey - CT Precertificate format in
>> 6962-bis
>>
>> [Only CABForum members can post to this list, hence why I'm forwarding
>> this message from Melinda Shore]
>>
>>
>> Hi, all:
>>
>> I co-chair the IETF "trans" working group, which is in the process of
>> developing a standards-track specification for certificate transparency
>> (logging).  We're trying to get a handle on the potential impact of
>> including serial numbers in precertificates.
>> Are there CAs who would otherwise implement CT but for whom either
>> needing to know the serial number of a certificate prior to it being
>> issued, or having to issue a certificate and precertificate
>> simultaneously would be 1) a complete non-starter, or 2) excessively
>> onerous?
>>
>> Thanks,
>>
>> Melinda
>>
>>
>> --
>> Rob Stradling
>> Senior Research & Development Scientist
>> COMODO - Creating Trust Online
>> _______________________________________________
>> Public mailing list
>> Public at cabforum.org
>> https://cabforum.org/mailman/listinfo/public
>>
>>
>> _______________________________________________
>> Public mailing list
>> Public at cabforum.org
>> https://cabforum.org/mailman/listinfo/public

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
Office Tel: +44.(0)1274.730505
Office Fax: +44.(0)1274.730909
www.comodo.com

COMODO CA Limited, Registered in England No. 04058690
Registered Office:
   3rd Floor, 26 Office Village, Exchange Quay,
   Trafford Road, Salford, Manchester M5 3EQ

This e-mail and any files transmitted with it are confidential and 
intended solely for the use of the individual or entity to whom they are 
addressed.  If you have received this email in error please notify the 
sender by replying to the e-mail containing this attachment. Replies to 
this email may be monitored by COMODO for operational or business 
reasons. Whilst every endeavour is taken to ensure that e-mails are free 
from viruses, no liability can be accepted and the recipient is 
requested to use their own virus checking software.


More information about the Public mailing list