Re: cert image I-D

[Phillip Hallam-Baker <hallam@xxxxxxxxx>]

I think this is usefull work to look at.

One change of approach I would suggest is to allow any extensions to
be expressed in either a cert itself or an OCSP response. That allows
for considerably greater flexibility in deployment as we discovered
was necessary during deployment of EV certs.

Think about the problem of enabling EV on every single web site of a
large bank at the same time, and the cost of customer service calls if
you do it piecemeal.

On Wed, May 13, 2009 at 1:56 PM, Stephen Kent <kent@xxxxxxx> wrote:
>
> Folks,
>
> I have reviewed the discussion on the list re Stefan's cert image proposal.
> While there were comments for and against, the positive comments, especially
> from folks who are in a position to make use of this feature, were
> persuasive.
>
> We will proceed with this a a new PKIX WG work item.  This is not a
> guarantee that the WG will approve a document, but rather that we will
> explore approaches to achieving the goals described by Stefan and try to
> come to consensus on a specific technical approach. We can decide later
> whether this is standards track, experimental or even informational.
>
> Steve
>
>



-- 
-- 
New Website: http://hallambaker.com/
View Quantum of Stupid podcasts, Tuesday and Thursday each week,
http://quantumofstupid.com/