Re: [Fwd: Warning: Your SSL Certificate on trust-value.com is expiring soon. Upgrade to 2048-bit today]

2009-03-12 Thread Eddy Nigg
On 03/13/2009 02:16 AM, Julien R Pierre - Sun Microsystems: Not true, there is a trust relationship : once you click, they can trust your e-mail address is real . :) LOL And very often you won't even need to click, if you have remote images enabled in your email. Nope, luckily I'm using Thu

Re: TC TrustCenter Root Inclusion Request

2009-03-12 Thread Eddy Nigg
On 03/09/2009 10:51 PM, kathleen95...@yahoo.com: * The TC TrustCenter Class 1 CA root has four internally-operated subordinate CAs which issue certificates for email and SSL client authentication. Only the email trust bit is requested for this root. Note that this root is 1024 bit and it expires

Re: [Fwd: Warning: Your SSL Certificate on trust-value.com is expiring soon. Upgrade to 2048-bit today]

2009-03-12 Thread Julien R Pierre - Sun Microsystems
Eddy, Eddy Nigg wrote: Once when I was naive enough and clicked for "unsubscribe" I've got ten times the amount of spam (since I just confirmed to them that I've read it and the account is real) until I closed the account altogether. Bad idea, no trust relationship exists in this respect.

Re: delta crl support

2009-03-12 Thread Julien R Pierre - Sun Microsystems
Dave, Yes, I did some benchmarks many years ago when I worked on the CRL cache. I was using a 26 MB CRL, and it was about 1 million revoked certs I believe. The RAM usage is significant, I think you can count on about 4-6x the size of the CRL. A CRL of that size may be OK on today's machines. B

Re: pk11util and pk11mode

2009-03-12 Thread Glen Beasley
marcelino jr esguerra wrote: wow! thanks for all the help. I've successfully build it now. But then again, how do i use pk11mode in testing pkcs? The goal of pk11mode is to test every function entry point of the PKCS11 api "that NSS provides" at least once. Once you built NSS set your path to fi

Re: how to sign data in javascript and get the signing public key

2009-03-12 Thread Anders Rundgren
Hi Jan, crypto.signText () is the closest you can get but it doesn't return a certificate but the signature in pkcs #7 format (AFAIK). https://developer.mozilla.org/en/JavaScript_crypto Anders - Original Message - From: "Jan Zach" To: Sent: Thursday, March 12, 2009 12:24 Subject: how

how to sign data in javascript and get the signing public key

2009-03-12 Thread Jan Zach
Hi everybody, I'm wondering whether it is possible to sign data in javascript with a certificate stored in the certificate manager and subsequently get the signing certificate public key similarly to M$'s CAPICOM api: var oSigner = new ActiveXObject("CAPICOM.Signer"); var signedData = new Activ

Re: delta crl support

2009-03-12 Thread dave davesons
Hi again, Does anyone know of any benchmarks regarding the size of CRLs towards performance? Or how much CRLs are supported at most? 2009/3/12 dave davesons > Hi, > > thanks for the clarification. BTW: OCSP is available in belgium. But we > like to have a fallback > > 2009/3/12 Nelson B Bol

Re: delta crl support

2009-03-12 Thread dave davesons
Hi, thanks for the clarification. BTW: OCSP is available in belgium. But we like to have a fallback 2009/3/12 Nelson B Bolyard > dave ("Mike") davesons wrote, On 2009-03-11 08:52: > > > In our organization we use nss to validate CRLs of the Belgian > Government. > > In a few months it is ex