Re: Firefox security too strict (HSTS?)?

2015-09-11 Thread Richard Barnes
On Fri, Sep 11, 2015 at 4:29 PM, Kurt Roeckx wrote: > On Fri, Sep 11, 2015 at 03:34:21PM -0400, Richard Barnes wrote: > > And that the certificate has the "identify websites" bit set? > > You mean that when it's important into firefox, he should say it > should be trusted for websites? Or are yo

Re: Remove Roots used for only Email and CodeSigning?

2015-09-11 Thread Rob Stradling
On 11/09/15 13:05, Gervase Markham wrote: > On 08/09/15 10:54, Rob Stradling wrote: >> Assuming this is still Mozilla's plan, please would you clarify which >> versions of Firefox and Thunderbird will be (or were?) the first >> versions that won't accept "normal CA-issued object-signing certificate

Re: Firefox security too strict (HSTS?)?

2015-09-11 Thread Kurt Roeckx
On Fri, Sep 11, 2015 at 03:34:21PM -0400, Richard Barnes wrote: > And that the certificate has the "identify websites" bit set? You mean that when it's important into firefox, he should say it should be trusted for websites? Or are you talking about an extention in the certificate itself? Kurt

Re: Firefox security too strict (HSTS?)?

2015-09-11 Thread Richard Barnes
And that the certificate has the "identify websites" bit set? On Fri, Sep 11, 2015 at 1:26 PM, Chris Palmer wrote: > On Thu, Sep 10, 2015 at 3:21 PM, AnilG wrote: > > Thanks Chris, I appreciate any help I can get. I'm trying to help IT get > > this fixed so we can keep FF. > > > > I already, an

Re: Policy Update Proposal: Remove Code Signing Trust Bit

2015-09-11 Thread Brian Smith
On Thu, Sep 10, 2015 at 1:20 PM, Kathleen Wilson wrote: > Proposal for version 2.3 of Mozilla's CA Certificate Policy: > > Remove the code signing trust bit. > > If this proposal is accepted, then there would be follow-up action items > that would need to happen after version 2.3 of the policy is

Re: Firefox security too strict (HSTS?)?

2015-09-11 Thread AnilG
Thanks Chris, I appreciate any help I can get. I'm trying to help IT get this fixed so we can keep FF. I already, and now again on your advice, imported to Firefox Authorities Certificates the same certificate that was circulated by IT in a package, which is presumably the OS installed certific

Re: Remove Roots used for only Email and CodeSigning?

2015-09-11 Thread Gervase Markham
On 08/09/15 10:54, Rob Stradling wrote: > Assuming this is still Mozilla's plan, please would you clarify which > versions of Firefox and Thunderbird will be (or were?) the first > versions that won't accept "normal CA-issued object-signing certificates" ? Extension signing was historically very r

Re: Policy Update Proposal: Remove Code Signing Trust Bit

2015-09-11 Thread Kurt Roeckx
On Thu, Sep 10, 2015 at 01:20:02PM -0700, Kathleen Wilson wrote: > Proposal for version 2.3 of Mozilla's CA Certificate Policy: > > Remove the code signing trust bit. > > If this proposal is accepted, then there would be follow-up action items > that would need to happen after version 2.3 of the

Re: Remove Roots used for only Email and CodeSigning?

2015-09-11 Thread Rob Stradling
On 08/09/15 10:54, Rob Stradling wrote: > Hi Gerv. > > It seems clear from [1] that Firefox (and Thunderbird?) does (or at > least did) use the NSS code signing trust bit for the purpose of > verifying that addons/extensions have been signed by publicly-trusted > code signing certs. > > I'm aware