security operator pin / "simple" pin change

2008-02-11 Thread Diego Zanga
Hi, I'm browsing all the api of the libraries but i cannot understand if an api to access with SO pin is available, and/or if a pin management api is available to change the pin code. anyone has some hint about examples, tutorial or something to understand how/if so pin/pin management api are ava

Re: PKCS#11 software token & concurrent database access

2008-02-11 Thread Eddy Nigg (StartCom Ltd.)
Robert Relyea wrote: If you want to start playing with it, try the instructions at http://wiki.mozilla.org/NSS_Shared_DB_Samples I wrote them up when we had the first alpha version of the shared database. I just went in and added a few comments to bring them up to date (you no longer have to

Re: Reassessment of sub-ordinated CA certificates

2008-02-11 Thread Eddy Nigg (StartCom Ltd.)
It would be nice to know to whom I'm talking... [EMAIL PROTECTED] wrote: > 1. Audit standards (WebTrust and ETSI for example) check that the CA > complies with its CPS - and that includes subordinates and external > RAs > > >From Webtrust: "In the hierarchical model, the root CA maintains the >

Re: PKCS#11 software token & concurrent database access

2008-02-11 Thread Robert Relyea
Eddy Nigg (StartCom Ltd.) wrote: Shared DB would be one of the greatest things! So I'm not able to judge if and when it can be done, but looking very much forward to it. Bob, how can I enable this for FF and TB to share the same DB? If you want to start playing with it, try the instruction

Re: Reassessment of sub-ordinated CA certificates

2008-02-11 Thread srdavidson
1. Audit standards (WebTrust and ETSI for example) check that the CA complies with its CPS - and that includes subordinates and external RAs >From Webtrust: "In the hierarchical model, the root CA maintains the established "community of trust" by ensuring that each entity in the hierarchy confor

Re: PKCS#11 software token & concurrent database access

2008-02-11 Thread Robert Relyea
Jean-Marc Desperrier wrote: Robert Relyea wrote: I'm currently running my Firefox and TB against the sqlite3 database. The main impediment to general deployment is Bug 391296. New NSS applications would not have to worry about the issues in Bug 391296. I really think than simply suppo

Re: Reassessment of sub-ordinated CA certificates

2008-02-11 Thread Eddy Nigg (StartCom Ltd.)
[EMAIL PROTECTED] wrote: >> "The end result is that anyone who chooses to spend a hundred thousand >> bucks or so on a single audit can then go around selling the benefit of >> their inclusion in the trust list to the highest bidder without fear of >> repercussion. Which is what they've been do

Re: Digicert request for root upgrade to EV

2008-02-11 Thread Frank Hecker
Frank Hecker wrote: > Digicert has applied to upgrade an existing root CA certificate for EV > use, as documented in the following bug: > > https://bugzilla.mozilla.org/show_bug.cgi?id=403644 > > and in the pending certificates list: > > http://www.mozilla.org/projects/security/certs/pendin

Re: Reassessment of sub-ordinated CA certificates

2008-02-11 Thread srdavidson
> "The end result is that anyone who chooses to spend a hundred thousand > bucks or so on a single audit can then go around selling the benefit of > their inclusion in the trust list to the highest bidder without fear of > repercussion. Which is what they've been doing. And nobody has the balls

Re: Reassessment of sub-ordinated CA certificates

2008-02-11 Thread Eddy Nigg (StartCom Ltd.)
Frank Hecker wrote: > I'm not sure what you mean by "cosmetically", With "cosmetic" I mean that nothing prevents a CA to establish the needed OID chain NSS will be looking for. There is (almost) no difference between issuing an intermediate CA certificate and issuing one with the needed OID. Th

Re: Exporting a private key from Firefox

2008-02-11 Thread Nelson Bolyard
[EMAIL PROTECTED] wrote, On 2008-02-09 08:04: > Hello, > > I'm stuck trying to export a private key generated by Firefox in the > process of obtaining a certificate. I received the corresponding > certificate in PEM format by email, but it has not yet been imported. It's unclear whether you're ul