3 ms·

https://bugzilla.mozilla.org/show_bug.cgi?id=1325532 https://bugzilla.mozilla.org/show_bug.cgi?id=1325532 > Google Trust Services is run by Google. Google is

https://bugzilla.mozilla.org/show_bug.cgi?id=1325532 https://bugzilla.mozilla.org/show_bug.cgi?id=1325532 > Google Trust Services is run by Google. Google is a commercial CA that will provide certificates to customers from around the world. We will offer certificates for server authentication, client authentication, email (both signing and encrypting), and code signing. Customers of the Google PKI are the general public. We will not require that customers have a domain registration with Google, use domain suffixes where Google is the registrant, or have other services from Google. Finding the "email" bit interesting. All this makes a lot of sense, and I'd say I'm surprised this didn't come sooner but the initial issue was filed 2 years ago, and they must have worked on this for several years already then. As an aside this is a fascinating glimpse into what it takes to run a (serious) CA. https://static.googleusercontent.com/media/pki.goog/en/GTS-CP-1.0.pdf https://static.googleusercontent.com/media/pki.goog/en/GTS-C...

TheSwordsman 8y ago
This URL 404s.
- tux3 8y ago
  Try: https://pki.goog/GTS-CP-1.0.pdf https://pki.goog/GTS-CP-1.0.pdf
- scrollaway 8y ago
  Weird. It needs the second slash. https://static.googleusercontent.com/media/pki.goog//en/GTS-CP-1.0.pdf https://static.googleusercontent.com/media/pki.goog//en/GTS-...
zokier 8y ago
I wouldn't read too much into the email part, that is pretty standard thing that pretty much all CAs do. I wouldn't expect Google to pursue email certificates in a major way. It's more like ticking a checkbox in the application and leaving that door open if the need arises. Also might be just some legacy from GlobalSign.
geofft 8y ago
Comments 28 and 29 confirm that they don't intend to sign email (S/MIME) certs for now, and the PDF from Mozilla in comment 30 says "Mozilla Trust Bits: Websites" and "Mozilla is no longer accepting requests to enable the Code Signing trust bit.", so I think the intent is only to sign websites for now. That sentence happens to list of four of the six standardized uses of certificates (RFC 5280 section 4.2.1.12; the other two are timestamping and OCSP responses) so I think that's just copied-and-pasted from somewhere. Somewhat poor form to copy-and-paste that if they don't mean it IMO, but it's just prose, not the technical part of the submission.

TheSwordsman 8y ago

This URL 404s.

tux3 8y ago
Try: https://pki.goog/GTS-CP-1.0.pdf https://pki.goog/GTS-CP-1.0.pdf
scrollaway 8y ago
Weird. It needs the second slash. https://static.googleusercontent.com/media/pki.goog//en/GTS-CP-1.0.pdf https://static.googleusercontent.com/media/pki.goog//en/GTS-...

zokier 8y ago

I wouldn't read too much into the email part, that is pretty standard thing that pretty much all CAs do. I wouldn't expect Google to pursue email certificates in a major way. It's more like ticking a checkbox in the application and leaving that door open if the need arises. Also might be just some legacy from GlobalSign.

geofft 8y ago

Comments 28 and 29 confirm that they don't intend to sign email (S/MIME) certs for now, and the PDF from Mozilla in comment 30 says "Mozilla Trust Bits: Websites" and "Mozilla is no longer accepting requests to enable the Code Signing trust bit.", so I think the intent is only to sign websites for now. That sentence happens to list of four of the six standardized uses of certificates (RFC 5280 section 4.2.1.12; the other two are timestamping and OCSP responses) so I think that's just copied-and-pasted from somewhere. Somewhat poor form to copy-and-paste that if they don't mean it IMO, but it's just prose, not the technical part of the submission.