Re: [Uta] Remarks on bcp-tls-sheffer-01

[Peter Saint-Andre <[e-mail]>]

On 2/3/14, 10:06 AM, Ralph Holz wrote:
> Hi,
>
>>> • Certificates MUST use at least SHA-1 (and MUST NOT use MD2 or MD5).
>>> • Certificates SHOULD use SHA-256 - this is preferable, if your clients
>>>     support this.
>>>     - Insert notes on which ones do and don't? Is this still a problem?
>>>     - If not, make SHA-256 a MUST.
>>
>> A small note about some non-HTTP software: in late 2012 I obtained a
>> certificate for the jabber.org IM service with a SHA-256 fingerprint. As
>> a result, many IM clients and peer servers were unable to connect, and I
>> decided it was necessary to revoke that certificate and instead obtain a
>> certificate with a SHA-1 fingerprint.
>>
>> I'm not sure what the state of play is in the browser world.
>
> My take on this is that the BCP is forward-looking, with that term being
> defined as "these should be established practices about six months after
> publication".

That seems right. Although the "c" stands for current, the "b" stands 
for "best". :-)

Peter

-- 
Peter Saint-Andre
https://stpeter.im/