Re[9]: S/MIME Encryption Certificate without email address

2011-03-23 Thread Konstantin Andreev
On 22.03.11 12:23, Sergei Evdokimov wrote: I think, being able to support encryption or having an option that enables or disables verification of email addresses in certificates would make sense. Here is a hint for you. At the lowest level, NSS doesn't track [email]->[certificate] relations,

Re[8]: S/MIME Encryption Certificate without email address

2011-03-23 Thread Konstantin Andreev
On 22.03.11 21:00, Robert Relyea wrote: On 03/22/2011 02:23 AM, silent...@gmail.com wrote: <...> the requirement is to allow having more than one <...> email provider AFTER the card was issued. <...> Unless there is an authoritative way to bind the cert to a given email address, there is no w

Re: S/MIME Encryption Certificate without email address

2011-03-23 Thread silent...@gmail.com
On Mar 22, 11:34 pm, Robert Relyea wrote: > On 03/22/2011 03:09 PM, silent...@gmail.com wrote: > > > > > > > > > Thank you for the reply! > > > On Mar 22, 7:00 pm, Robert Relyea wrote: > >> Unless there is an authoritative way to bind the cert to a given email > >> address, there is no way to use

Re: S/MIME Encryption Certificate without email address

2011-03-22 Thread Robert Relyea
On 03/22/2011 03:09 PM, silent...@gmail.com wrote: > Thank you for the reply! > > On Mar 22, 7:00 pm, Robert Relyea wrote: >> Unless there is an authoritative way to bind the cert to a given email >> address, there is no way to use those certs for email. If you want email >> certs to interoperate

Re: S/MIME Encryption Certificate without email address

2011-03-22 Thread silent...@gmail.com
Thank you for the reply! On Mar 22, 7:00 pm, Robert Relyea wrote: > Unless there is an authoritative way to bind the cert to a given email > address, there is no way to use those certs for email. If you want email > certs to interoperate with people from outside of the infrastructure, > the only

Re: S/MIME Encryption Certificate without email address

2011-03-22 Thread Nelson B Bolyard
On 2011/03/22 02:23 PDT, silent...@gmail.com wrote: > Well, the reasons are at least obvious to us :) - the card is supposed > to be in use for least 5 years. Card owners (Health Care Providers in > our case) should be able to use various email providers for exchanging > medical reports. Nothing

Re: S/MIME Encryption Certificate without email address

2011-03-22 Thread Robert Relyea
On 03/22/2011 02:23 AM, silent...@gmail.com wrote: > Well, the reasons are at least obvious to us :) - the card is supposed > to be in use for least 5 years. Card owners (Health Care Providers in > our case) should be able to use various email providers for exchanging > medical reports. The email p

Re: S/MIME Encryption Certificate without email address

2011-03-22 Thread silent...@gmail.com
Well, the reasons are at least obvious to us :) - the card is supposed to be in use for least 5 years. Card owners (Health Care Providers in our case) should be able to use various email providers for exchanging medical reports. The email providers will be not gmail or yahoo, of course, but still t

Re: S/MIME Encryption Certificate without email address

2011-03-20 Thread Nelson B Bolyard
On 2011/03/17 02:41 PDT, silent...@gmail.com wrote: > It seems that Thunderbird refuses to use X.509 certificates for S/MIME > encryption when these certificates do not contain email address of the > subject. We want to use S/MIME with keys stored on smart cards and > certificates distributed via L

S/MIME Encryption Certificate without email address

2011-03-17 Thread silent...@gmail.com
It seems that Thunderbird refuses to use X.509 certificates for S/MIME encryption when these certificates do not contain email address of the subject. We want to use S/MIME with keys stored on smart cards and certificates distributed via LDAP. For obvious reasons we cannot attach certificates to fi