Bug#721976: Roots trusted for email but not TLS

2016-03-10 Thread Michael Prokop
Hi, * Andrew Ayer [Wed Dec 16, 2015 at 09:54:58AM -0800]: > On Mon, 14 Dec 2015 21:59:27 -0600 Michael Shuler > wrote: > > Thanks for your thoughts. A separate package is an interesting interim > > idea, but in looking at what redhat has done, I think a more complete > > transition to trust type

Bug#721976: Roots trusted for email but not TLS

2015-12-16 Thread Andrew Ayer
Hi Michael, On Mon, 14 Dec 2015 21:59:27 -0600 Michael Shuler wrote: > Thanks for your thoughts. A separate package is an interesting interim > idea, but in looking at what redhat has done, I think a more complete > transition to trust type buckets is preferred, along with including a > code-sig

Bug#721976: Roots trusted for email but not TLS

2015-12-14 Thread Michael Shuler
On 12/14/2015 07:45 PM, Andrew Ayer wrote: > On Mon, 14 Dec 2015 18:45:40 -0600 > Michael Shuler wrote: > >>> As always, let me know if you could use any help. I'm going to >>> start looking through the reverse depends for ca-certificates to >>> identify packages that might be relying on roots f

Bug#721976: Roots trusted for email but not TLS

2015-12-14 Thread Andrew Ayer
On Mon, 14 Dec 2015 18:45:40 -0600 Michael Shuler wrote: > > As always, let me know if you could use any help. I'm going to > > start looking through the reverse depends for ca-certificates to > > identify packages that might be relying on roots for email > > authentication. > > Exactly. I also

Bug#721976: Roots trusted for email but not TLS

2015-12-14 Thread Michael Shuler
On 12/14/2015 06:18 PM, Andrew Ayer wrote: > Hi Michael, > > Have you given any more thought to a redesign of ca-certificates that > separates the email certificates from the TLS certificates? I suspect Yep - got a patch? :-) > that the vast majority of packages that depend on ca-certificates

Bug#721976: Roots trusted for email but not TLS

2015-12-14 Thread Andrew Ayer
Hi Michael, Have you given any more thought to a redesign of ca-certificates that separates the email certificates from the TLS certificates? I suspect that the vast majority of packages that depend on ca-certificates use it for TLS server auth, and yet there are currently 21 roots in the NSS sto