Policy-Discussion

[Duane <duane AT cacert.org>]

Kyle Hamilton wrote:

> Which model?  Does OpenSSL have an ENGINE for it?

I was lead to believe there is support for it, but I haven't had the 
time to play with it for a number of personal reasons.

> ...but if the new root is accepted by browser manufacturers, that'll
> happen automatically.  (If it's accepted by Microsoft, it becomes part
> of the root certificate update.)

There will be some time to spread in other browsers, at present more 
then 50% of our hits come from users of other browsers so this can't be 
discounted easily.

> Security may be inconvenient.  The question is, what are these certs
> going to be used for?  Financial transactions?  Site authentication? 
> Anything else?

The original intention was better wifi security, however people have 
used issued certificates for virtually every purpose you can think of 
and then some.

While we have a little bit of a say over things now, it was perceived in 
the beginning that no one would want to go to the trouble of loading 3 
or 4 root certs, so that was the premise we were operating around.

--

Best regards,
 Duane

http://www.cacert.org - Free Security Certificates
http://www.nodedb.com - Think globally, network locally
http://www.sydneywireless.com - Telecommunications Freedom
http://e164.org - Using Enum.164 to interconnect asterisk servers

"In the long run the pessimist may be proved right,
    but the optimist has a better time on the trip."