Re: Debian Weak Key Problem

2008-06-13 Thread Paul Hoffman
http://news.netcraft.com/archives/2008/06/12/ssl_certificates_vulnerable_to_openssl_flaw_on_debian.html The last paragraph says: = Although a number of certificate authorities have offered free replacement certificates to customers affected by the Debian OpenSSL vulnerability, it has been r

Re: Problematic Practices

2008-06-13 Thread David E. Ross
On 6/12/2008 4:46 PM, Wan-Teh Chang wrote [in part]: > If a company or school needs to issue a lot of certs to its internal > servers, what is the recommended practice? I always thought the > organization should operate an intermediate CA subordinate to a > root CA. Isn't that the hierarchical m

Re: Debian Weak Key Problem

2008-06-13 Thread Jean-Marc Desperrier
Gervase Markham wrote: > Jean-Marc Desperrier wrote: >> Well, CRL can also be made to scale properly to handle a large number of >> revocation, but this requires a few operationnal changes. > > ...which presumably have to be made before you issue the certs? Yes, but the reason why only 20% of the

RE: Bug question

2008-06-13 Thread David Stutzman
Nelson B Bolyard: > On your system, is certutil a shell script that runs a program named > certutil-bin ? As Eddy said about getting it from a directory server install, the Directory/Certificate System products have been doing that for quite a while now. >From a system with Red Hat CS 7.1 instal