-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 On 05/28/2014 08:30 AM, Christian wrote: > Hey, > > and while we are on the subject: If I install my Class 2 (!) OV > Certificate from startssl the hkps button changes red. A valid > certificte is not valid. I can understand that self-signed > certificates will turn the hkps indicator red, but why don't we > accept OV certificates that every client will accept in the first > place?
They will not be able to issue a certificate related to hkps.pool.sks-keyservers.net as CN or subjectAltName, i.e. the validation on a pool would fail. > > I hardly think that *any* client has the CA of sks installed per > default (nor would an average client care to). it is part of gnupg 2.1 [0] > > And the validation von sks CA is the save as a Class 1 DV > certificate. > > > tl;dr: We should allow valid signed certificates by default, > alongside of the SKS Ca and only turn the button red on self-signed > (or invalids). > Users are free to choose any server they want. References [0] http://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=blob;f=dirmngr/sks-keyservers.netCA.pem;h=24a2ad2e8e39498b4842bd31689f230148d08693;hb=refs/heads/master - -- - ---------------------------- Kristian Fiskerstrand Blog: http://blog.sumptuouscapital.com Twitter: @krifisk - ---------------------------- Public PGP key 0xE3EDFAE3 at hkp://pool.sks-keyservers.net fpr:94CB AFDD 3034 5109 5618 35AA 0B7F 8B60 E3ED FAE3 - ---------------------------- Ubi mel ibi apes Where there's honey, there are bees -----BEGIN PGP SIGNATURE----- iQIcBAEBCgAGBQJThbY4AAoJEPw7F94F4TagFSQP/0HdW23IqAslOgiDUQEFICAu Okprf1lKxZSvozaF+KujKWMFzwHhuaq0QfALX7gm5CYVI23HO8W5i+cP+UNZWiTr Ey1z1tR8gUXImXS0mjGE3RBo8E6Y1aLUXYBYhXD8dJaHtMHSAIbw+MMS/LljRUPW FQIQb2yHq0tWWG7bcrMjA6TGEe41GtgEJQo9saJI0mR11OgmlEx4WFbPU7zwkWr+ 6ZaAj6hiqX3Bn22jSxXs+zC6DCwdcpKFdJJWfG9zimNiHFBquihfnTukmUYCQ2UI wPARBDq+yIvAwhvWBmbmq/QtiqAGzbsEi8fGojTkpC2jq3yMI4iOI9qeE5O66WVt TshtCLmZt9v05DKXiMXbWmE8TpDLOKpc1tXSHzxcu/TB1DY48CZMJkIdGzCRyMWy b9F0tAAKuWqybtsJ3Nehzkh6gdgfo1Qo6g9Qcki153qeuyMUMJyHq9nNg9Xwu9uF 0OvLdF2joUmGkuE1orDmq95PzT7PKBXis2eyVyaSqqu6ctNgbbF0+Eg3pgO8pofQ 8kL/zYEcOT4lRkDF0K32WUak1rWse7vhUOg7UTgSLD43N+RIFOwUzPfdJ7Jqe2rV /TwT50wyy5QTFNHSzPNRjPRXcwG6ROc3QjUjS2nWfW+h/G8s0/6oGV5oxLBeiKF0 LhNlkTnLpN8LOowc/bwP =Qy7y -----END PGP SIGNATURE----- _______________________________________________ Sks-devel mailing list Sks-devel@nongnu.org https://lists.nongnu.org/mailman/listinfo/sks-devel