Philippe lhardy: digest of mailling list exchanges

2013-05-25T06:41:54Z

digest of mailling list exchanges

New page

I don't believe this is correct: "Certificates are NOT free" Obtaining
a certificate from a well known Certificate Authority typically
requires that you pay a fee.

StartCom issues free Class 1 Certificates. The cost is in revocation,
and Startcom is unique in that they charge on the back side if
revocation is required, rather than the front side like most CAs.

For completeness, Class 1 is the lowest class, while Class 3 or 4 (or
whatever N they choose - its arbitrary and meant to baffle the
purchaser) is the highest class. I think "Extended Validation" or EV
Certificates are usually about a Class 3.

Jeff
___

I don't believe this is correct: A certificate knows from its creation
what job it will do. There is no way a certificate issued for
authenticating a server can be used in a browser to identify a user.
Certificates have a purpose.

If you enforce Basic Constraints, Key Usage (KU), and Extended Key
Usage (EKU), most PKIs break. Confer: "Code Signing: Breaks for Device
when enforcing Basic Constraints on WWDR CA,"
http://openradar.appspot.com/radar?id=3011403. There's tens of
thousands of other examples.

Jeff
___

I don't believe this is correct: "A Certificate without a private key
is like glasses without eyes" A certificate does not contain the
private key. If you have a certificate and you lose your private key,
then the certificate is unusable.

After a signing key is retired, a CPS will often state the private key
is destroyed to ensure no new signatures. The certificate (and its
public key) are still needed for signature verification.

Jeff

___

- "unusable to prove your current identity" - would be better.

I do agree with all those remarks; but as usual when doing simplicifications for beginners ( see Category:Beginner ),
many subtilities are left out.

When you face questions like :
Can i renew a certificate ? And user does not know he needs a private key do so.
Why my browser refuses to install a Client Certifcate in my browser ? because it is a Certificate and not a PFX containing private key
Why i can't connect to my server in https even after installing a Certificate ? Because you didn't install a private key...

You quickly understand that in mind of users beginning with Certificate use, Certificate itself means everything needed to prove identity, ownship and anything.
I fell important to recall that Private Key is the key point of Certificate usage.

I will put all those comment in Discussion tab of Certificate LifeStyle...

Philippe

Talk:Certificate Lifecycle - Revision history

Philippe lhardy: digest of mailling list exchanges