Re: Comodo ECC CA inclusion/EV request

2008-08-06 Thread Eddy Nigg
Robin Alden: > Eddy Nigg said: >> In http://www.mozilla.org/projects/security/certs/policy/ section 7 >> explicitly states: >> >> "for a certificate to be used for SSL-enabled servers, the CA takes >> reasonable measures to verify that the entity submitting the certificate >> signing request has re

Re: Creating detached PKCS#7 signature with cmsutil

2008-08-06 Thread Michael Ströder
Nelson B Bolyard wrote: > Michael Ströder wrote, On 2008-08-06 04:07: >> Nelson B Bolyard wrote: cmsutil -D -d ~/.mozilla/xxx/ -c name.tar.gz -i name.tar.gz.p7m -o test >>> I remember running into this long ago. As I recall, the pass/fail result >>> is very subtle. It may be nothing more

Re: NSS documentation guidance request

2008-08-06 Thread Nelson B Bolyard
Gordon.Young wrote, On 2008-08-05 19:45: > I need help finding a document(s) to help me understand cross > certification and path building/chaining in the NSS world. The document you want probably doesn't exist. :-( > we are doing signing something like this: > > *Private root*>subordinate is

Re: Importing symmetric keys to NSS from Java code

2008-08-06 Thread Nelson B Bolyard
Yevgeniy Gubenko wrote, On 2008-08-06 05:10: > Hello, > > I have some predefined key to use it by some symmetric algorithm > (AES/CBC/NoPadding for example) for encryption/decryption in Java 1.6 > code which works with NSS crypto in fips mode through PKCS#11 bridge. > > The questions are: > > 1.

Re: Creating detached PKCS#7 signature with cmsutil

2008-08-06 Thread Nelson B Bolyard
Michael Ströder wrote, On 2008-08-06 04:07: > Nelson B Bolyard wrote: >>> cmsutil -D -d ~/.mozilla/xxx/ -c name.tar.gz -i name.tar.gz.p7m -o test >> I remember running into this long ago. As I recall, the pass/fail result >> is very subtle. It may be nothing more than the program's result cod

Re: Wells Fargo CA inclusion/EV request

2008-08-06 Thread Frank Hecker
Frank Hecker wrote: > Frank Hecker wrote: >> I am now opening the first public discussion period for a request from >> Wells Fargo to add the WellsSecure Public Root Certificate Authority >> root certificate to Mozilla and enable it for EV use. This is bug >> 428390, and Kathleen has produced an

Re: Comodo ECC CA inclusion/EV request

2008-08-06 Thread Frank Hecker
Eddy Nigg wrote: > My point was that Comodo does issue certificates according to the > problematic practices listed in our document. Not only that, it does > more than one of those practices. You stated in the bug however that > Comodo doesn't issue certificates according to the "Problematic Pra

Re: Question about importing PKCS#7 chain

2008-08-06 Thread Jamie
Thank you so much for your help! I will look into submitting an enhancement request. "Nelson B Bolyard" <[EMAIL PROTECTED]> wrote in message news:[EMAIL PROTECTED] > Jamie wrote, On 2008-08-04 12:12: >> I am attempting to allow users to import a PKCS#7 certificate chain into >> their browser, b

Importing symmetric keys to NSS from Java code

2008-08-06 Thread Yevgeniy Gubenko
Hello, I have some predefined key to use it by some symmetric algorithm (AES/CBC/NoPadding for example) for encryption/decryption in Java 1.6 code which works with NSS crypto in fips mode through PKCS#11 bridge. The questions are: 1. Am I constrained to import the predefined key to NSS db

Re: Creating detached PKCS#7 signature with cmsutil

2008-08-06 Thread Michael Ströder
Nelson B Bolyard wrote: >> cmsutil -D -d ~/.mozilla/xxx/ -c name.tar.gz -i name.tar.gz.p7m -o test > > I remember running into this long ago. As I recall, the pass/fail result > is very subtle. It may be nothing more than the program's result code. > > What did you get in the "test" file?

Re: Creating detached PKCS#7 signature with cmsutil

2008-08-06 Thread Michael Ströder
Nelson B Bolyard wrote: > Michael Ströder wrote, On 2008-08-05 15:44: >> Michael Ströder wrote: >>> I also tried signver but this hangs: >>> >>> signver -V -v -d ~/.mozilla/xxx/ -i name.tar.gz -s name.tar.gz.p7m >>> >>> strace output of hanging signver: >>> >>> - snip --

RE: Comodo ECC CA inclusion/EV request

2008-08-06 Thread Robin Alden
Eddy Nigg said:- > Robin Alden: > > f) refers to an SSL product which is limited in such a way that it isn't > > generally usable on the public internet. We offer no warranty on the > > product, and the main part of the domain validation is to ensure that > the > > domain name in the certificate i