Re: Symantec Response L

2017-04-16 Thread Peter Bachman via dev-security-policy
The 2017 ACES CP excluding anything other than citizen to E-gov breaks certain use cases that are outside the scope of Mozilla, but not from the standpoint of a fully functional commercial c=US structure which I have developed since 1996 since I reached an agreement with GSA on how to proceed

Re: Symantec Response L

2017-04-16 Thread Eric Mill via dev-security-policy
For the benefit of the list, I'm the author of that text and that quote is from this page, which is maintained by the General Services Administration (though again, not by the Federal PKI team): https://https.cio.gov/certificates/#does-the-us-

Re: Symantec Response L

2017-04-16 Thread Peter Bachman via dev-security-policy
Since we use ACES certificates for sending healthcare information in a way that mimimizes MITM, I was surprised to read the following. "The Federal PKI has cross-certified other agencies and commercial CAs, which means their certificates will be trusted by clients that trust the Federal PKI.

Re: CloudFlare Issuing SHA-1 SSL Certificates

2017-04-16 Thread Nick Lamb via dev-security-policy
On Saturday, 15 April 2017 13:59:18 UTC+1, Samuel Pinder wrote: > Quite an interesting workaround to support older > software, it's not exactly encouraging since SHA-1 collisions are now > possible. I would expect that CloudFlare operate this solution on the > condition that their customers are