Re: [wpkops] draft-housley-web-pki-problems-00

Jeremy Rowley <> Tue, 07 July 2015 19:36 UTC

Return-Path: <>
Received: from localhost ( []) by (Postfix) with ESMTP id 3AB531A21C3 for <>; Tue, 7 Jul 2015 12:36:43 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.313
X-Spam-Status: No, score=-2.313 tagged_above=-999 required=5 tests=[BAYES_40=-0.001, RCVD_IN_DNSWL_MED=-2.3, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Sq2VGeF6KfdN for <>; Tue, 7 Jul 2015 12:36:41 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id D44D81A1B1F for <>; Tue, 7 Jul 2015 12:36:41 -0700 (PDT)
From: Jeremy Rowley <>
To: Russ Housley <>, "" <>
Thread-Topic: [wpkops] draft-housley-web-pki-problems-00
Thread-Index: AQHQuMVQY4sV5YvCFk+fNcTud623Ip3QYTgA
Date: Tue, 7 Jul 2015 19:36:39 +0000
Message-ID: <>
References: <>
In-Reply-To: <>
Accept-Language: en-US
Content-Language: en-US
x-ms-exchange-transport-fromentityheader: Hosted
x-originating-ip: []
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <>
Subject: Re: [wpkops] draft-housley-web-pki-problems-00
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 07 Jul 2015 19:36:43 -0000

This paper sounds like a wish list of select issues taken from the Mozilla forums.  I don't see why it would be published as informational RFC? Is the goal to make a list of issues that community members feel need to be discussed? I don't get it.

The conclusions seem to be 1) Have a CAB Forum that is more transparent (which is out of scope of the IEFT - I'm not sure I've ever seen an IETF paper specifically call out to another industry body requesting a change in its membership?) and 2) Use Let's Encrypt - one specific member of the CA community.  Many CAs already offer free tools to automate issuance, making the call out to Let's Encrypt very odd in an IETF document, especially where the touted feature - new automated tools - already exist (  I have a similar complaint about the reference to acme where PHB has been proposing something similar for a LONG time ( 

I'm also not sure why you selected the specific issues for inclusion in the paper. For example, the paper doesn't mention inconsistencies in validation levels, which (imo) is a bigger issue than the "too big to fail" scenario. Cost also is a weird issue to include in the document since it's always relative.  It's also very difficult to discuss without running afoul of anti-trust laws.


-----Original Message-----
From: wpkops [] On Behalf Of Russ Housley
Sent: Tuesday, July 7, 2015 8:57 AM
Subject: [wpkops] draft-housley-web-pki-problems-00

I want to make people on this list aware of this draft that was posted yesterday.

Stephen Farrell suggested that this list might be a good place to discuss it.


wpkops mailing list