Re: [therightkey] Barely-capable CAs

[Rob Stradling <[e-mail]>]

On 01/11/12 19:54, Paul Hoffman wrote:
> On Nov 1, 2012, at 11:52 AM, Rob Stradling <[e-mail]> wrote:
>
>> On 01/11/12 16:46, Paul Hoffman wrote:
>>> On Nov 1, 2012, at 9:29 AM, Phillip Hallam-Baker <[e-mail]> wrote:
>>>
>>>> This is about barely capable sysadmins.
>>>>
>>>> Different problem.
>>>
>>>>  From the perspective of the relying party (me, caring about making a secure connection to my bank), the problems are indistinguishable. A CA who retains a sysadmin who is barely capable
>>
>> Paul, this is about barely capable sysadmins _at your bank_, not at the CA.
>>
>> (Ben wrote "The process of participating in CT for a _server operator_ is...")
>
> OK, maybe I'm confused here, or maybe you are. If my bank has a certificate issued by a CA who is actively participating in CT, there is no requirement on the bank at all, correct?

If by "actively participating" you mean that the CA has embedded the CT 
proof in the cert, then yes, there is no requirement on the bank.

If the CA instead embeds the CT proof in OCSP Responses relating to the 
cert, then there is no requirement on the bank apart from to use OCSP 
Stapling.

If the CA is not participating in either of these 2 ways, then there is 
a requirement on the bank (aka the "server operator"), which may or may 
not be rocket science, depending on your opinion.

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online