IETF Logo Mail Archive

Re: [lamps] rollover of CA

Deb Cooley <debcooley1@gmail.com> Mon, 06 September 2021 10:43 UTC

Return-Path: <debcooley1@gmail.com>
X-Original-To: spasm@ietfa.amsl.com
Delivered-To: spasm@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 919CD3A2AD9 for <spasm@ietfa.amsl.com>; Mon, 6 Sep 2021 03:43:47 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.847
X-Spam-Level:
X-Spam-Status: No, score=-1.847 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_ENVFROM_END_DIGIT=0.25, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BjTc50HP9n_P for <spasm@ietfa.amsl.com>; Mon, 6 Sep 2021 03:43:42 -0700 (PDT)
Received: from mail-ot1-x32e.google.com (mail-ot1-x32e.google.com [IPv6:2607:f8b0:4864:20::32e]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3B8FD3A2AD7 for <spasm@ietf.org>; Mon, 6 Sep 2021 03:43:42 -0700 (PDT)
Received: by mail-ot1-x32e.google.com with SMTP id a20-20020a0568300b9400b0051b8ca82dfcso8286304otv.3 for <spasm@ietf.org>; Mon, 06 Sep 2021 03:43:42 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=AbOKF3Ahe+bJw0ZBTs5e80gHzUTKoyx8uHM3FXP7I8s=; b=WJjzofTUcT+CuIxYhVR0FYXxuFA3M8zXNwoQn/UjGSkh1jTeSaIyd0jl3NfzZ16TRE 6vhyOO/uj89qO2AIASngP0b3ZfjKL/hYn+R5kFpqtz7TrIp82huiMuw+aEVaAv6MKcgw RJRxusMwSGuRZwZA8ry/B0Sg8Az9oRmaaVrV3e3H9SY6r/Qb4KoR70Z6GVfhRrd+DyfD whiXhKEJnT/ZSo3hZpoUUAxKmm6znTdXFVor6KXG+UGRctwqxaYGTsPWCu+LetA1MXPC Rkv7/+2zB5dWaZ7mgdCt49izyoQvtcXFlL2RquHPoQIVi3M8rB++EcY/WTRa+zzRWEgv T68g==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=AbOKF3Ahe+bJw0ZBTs5e80gHzUTKoyx8uHM3FXP7I8s=; b=mugU23mrhxhoOIyJc5pa5gYi05prlG3+LtLBhaKdznyB6agAbwJizA1bXFA1hGT39o gPTmBnMaYX+7tZgUfggw6an446A3wqJP9pNButhitlCnHduL3yQe/Hl+EZ1hzOiH+Yfw cdxOeifpv/XSktWn72TE7J/B9YsnneIqlZ9v8b5UmnUf+ACcDCorYRX2Mnh9SpxASVl1 yReCF3bc2A+1TnTSvPWhfbello+SN4yr5xvPqs02nyC8tFktzZilMjM88IdwompbAFWJ ERkF8BKk/2211ie1q4XpQNcuAJPign8D/s7umeO55R4EsE7HwBaRQlAGOrOd2ws0fS4V 1isQ==
X-Gm-Message-State: AOAM5311Wl17Wp30yIGRvuMX+yCGHOKF8c/ZCsZkhgZc04ZhRJcj8NTX s4Nzy5XNeR0tKIIgdhp31xfgFd7yEJCX3X6LE+rpPgY=
X-Google-Smtp-Source: ABdhPJxFlGS+1o+VG5wMQ0oxnG+GzZegPXP2I7Pm/Rax1bhHG6ns1YEUaj4XVC44t0l/pXm9xAfqglUywXt9cwgiA+w=
X-Received: by 2002:a05:6830:1b6f:: with SMTP id d15mr9848474ote.158.1630925020853; Mon, 06 Sep 2021 03:43:40 -0700 (PDT)
MIME-Version: 1.0
References: <17240.1630591789@localhost> <CAErg=HH9o8wXgo9RS0GDrn6ZgL7TD3TF25PiUNW7XePML7252w@mail.gmail.com> <CAGgd1Odk-xVmYb8-i-1pCv-n=oeFCnjt-xsCC9mqvGowaLpeZg@mail.gmail.com> <16957.1630692060@localhost>
In-Reply-To: <16957.1630692060@localhost>
From: Deb Cooley <debcooley1@gmail.com>
Date: Mon, 06 Sep 2021 06:43:29 -0400
Message-ID: <CAGgd1OfAF-UbeMyqjtdN461JfNJ7g9QuYhasHUSD6v6wUAwnVQ@mail.gmail.com>
To: Michael Richardson <mcr+ietf@sandelman.ca>
Cc: SPASM <spasm@ietf.org>
Content-Type: multipart/alternative; boundary="00000000000085f94705cb51525b"
Archived-At: <https://mailarchive.ietf.org/arch/msg/spasm/J2h1Xms7uPNRE70Z8OUZizW822Q>
Subject: Re: [lamps] rollover of CA
X-BeenThere: spasm@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "This is a venue for discussion of doing Some Pkix And SMime \(spasm\) work." <spasm.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/spasm>, <mailto:spasm-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/spasm/>
List-Post: <mailto:spasm@ietf.org>
List-Help: <mailto:spasm-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/spasm>, <mailto:spasm-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 06 Sep 2021 10:43:48 -0000

simply CA10 is replaced by CA11.  Merely a one up counter.

On Fri, Sep 3, 2021 at 2:01 PM Michael Richardson <mcr+ietf@sandelman.ca>
wrote:

>
> Deb Cooley <debcooley1@gmail.com> wrote:
>     > What exactly are you interested in?
>
> Ryan got it exactly.
> This is about rollover of CAs in IoT systems.
> These aren't public today, but it needs to rekey, not-re-enroll.
> There is a fair bit of concern out there about
>
>     > over.  We stand up new Roots and new subCAs.  In general, we don't
> name
>     > them the same.  When a new Root or sub CA is stood up, we make an
>     > announcement to the community and there is an app that makes it
> easier
>     > to do the trust store management. US Fed PKI just stood up a new Root
>     > CA for their Common Policy Root CA - same thing, different name,
>     > different keys, different dates, and (I think) different key sizes.
>
> So, by "don't name them the same", you mean, the new one is "Federal Super
> Issuer 2021" vs "Federal Super Issuer 2011"?
>
>
> --
> Michael Richardson <mcr+IETF@sandelman.ca>   . o O ( IPv6 IøT consulting )
>            Sandelman Software Works Inc, Ottawa and Worldwide
>
>
>
>
>

v2.23.0 | Report a Bug | By Email