Policy-Discussion

[Daniel Black <daniel AT cacert.org>]

On Thursday 14 January 2010 22:22:25 Alexander Prinsier wrote:
> On 01/14/2010 02:49 AM, Daniel Black wrote:
> >> I am against it, since we still have users that require Class3
> >> certificates for their applications.
> >> One such application I know of is http://registeredcommons.org/
> >> There might be others as well that I have not heard about yet.
> >
> > it seems as though they could achieve the same thing with class1
> > certificates.
> >
> >         SSLVerifyDepth 3
> >         SSLCACertificatePath /usr/share/ca-certificates/cacert.org/
> >         SSLCADNRequestPath /usr/share/ca-certificates/cacert.org/
> >         SSLOptions +StdEnvVars +ExportCertData
> >     SSLRequire %{SSL_CLIENT_S_DN_CN} != 'CAcert WoT Member'
> 
> Why doesn't registeredcommons use the class3 as their trusted root, and
> not the class1? (at least for the purpose of verification in apache). It
> looks more simple to me.

ask them.

> Same idea for those 2 universities: why don't they install the class3 as
> their trusted root instead of class1?

Because trust verification isn't the issue for these two universities.

-- 
Daniel Black