similar to: Simple OCSP server ??

On 04/14/2017 10:41 PM, Alice Wonder wrote: > https://www.openca.org/ might fit my needs. their Centos repo does not exist, it seems? > > On 04/14/2017 06:29 PM, Alice Wonder wrote: >> Hello list, >> >> I'm contemplating running my own CA to implement the new proposed ISP >> for validation of S/MIME certificates via DANE. >> >> I already use

What about the pki package that comes with Centos? pki-server and pki-ca? On 04/16/2017 11:54 AM, Alice Wonder wrote: > Oh I don't know, their github works. > > However it seems that it isn't able to deal with more than one ocsp > signing key. > > On 04/16/2017 08:40 AM, Robert Moskowitz wrote: >> >> >> On 04/14/2017 10:41 PM, Alice Wonder wrote:

Oh I don't know, their github works. However it seems that it isn't able to deal with more than one ocsp signing key. On 04/16/2017 08:40 AM, Robert Moskowitz wrote: > > > On 04/14/2017 10:41 PM, Alice Wonder wrote: >> https://www.openca.org/ might fit my needs. > > their Centos repo does not exist, it seems? > >> >> On 04/14/2017 06:29 PM, Alice

https://www.openca.org/ might fit my needs. On 04/14/2017 06:29 PM, Alice Wonder wrote: > Hello list, > > I'm contemplating running my own CA to implement the new proposed ISP > for validation of S/MIME certificates via DANE. > > I already use self-signed for my MX servers (with 3 1 1 dane records on > TCP port 25) but I don't want to use self-signed for S/MIME for

On 05/01/2018 09:08 AM, Aki Tuomi wrote: > >> On 01 May 2018 at 19:03 Felipe Gasper < felipe at felipegasper.com >> <mailto:felipe at felipegasper.com>> wrote: >> >> >> Hi, >> >> For CAs that do not include a signed certificate timestamp in their >> newly-issued certificates, does Dovecot support either OCSP stapling >> or the

Hi, For CAs that do not include a signed certificate timestamp in their newly-issued certificates, does Dovecot support either OCSP stapling or the Certificate Transparency TLS extension? If the TLS extension is supported, how does the admin configure the timestamp for each certificate? I?m wondering if any MUAs will follow Google?s lead and insist on CT. Thank you! -Felipe Gasper

On 03-03-16 14:09, Gedalya wrote: > On 03/03/2016 07:30 AM, Stephan Bosch wrote: >> BTW, I can imagine that Thunderbird can already do that, as it shares much of the Firefox code base. > Thunderbird definitely does validate certificates via OCSP, enabled by default and I've run into that the hard way a couple of times wrt StartSSL having issues with their responder. This isn't

Op 3-3-2016 om 13:04 schreef A. Schulze: > > dovecot: > >> So I would like to know if Dovecot is planning to feature OCSP stapling. >> That way I know for sure my "must staple" certificates can be used by >> Dovecot. And in my opinion, every TLS offering daemon should be up to >> par to the capabilities of TLS.. Not lag behind :) >> >>

Hi all, About a year ago, Torsten already asked for OCSP stapling (http://dovecot.org/pipermail/dovecot/2015-April/100632.html). Unfortunately, there was no answer to his question. Now RFC 7633 ("TLS Feature Extension", https://tools.ietf.org/html/rfc7633, a.k.a. "Must Staple") has landed, revocation is getting serious! I personally would like to embed all my TLS

On 03-03-16 13:04, A. Schulze wrote: > > dovecot: > >> So I would like to know if Dovecot is planning to feature OCSP stapling. >> That way I know for sure my "must staple" certificates can be used by >> Dovecot. And in my opinion, every TLS offering daemon should be up to >> par to the capabilities of TLS.. Not lag behind :) >> >> What's

That is one of the reasons I do not bother since long with public CAs but rather deploy my own, including own OSCP responder. Which has of course has some drawbacks like redundancy, resilience, bandwidth provision, geographical spread, implementing CA security standards and CA trust in clients. Latter though could be easily overcome if browser and email clients were to support DNSSEC/DANE

Hi all, Can anybody inform me wether the "RedHat Certificate System" or actually a CentOS equivalent is available for CentOS. Just skimmed on a download site through the RPM's for 5.3 and I couldn't find it. According to their pressrelease, it the code should be gpl, allthough I can't find any rpm for RH, FC or Centos. It seems that this is one of the few CA-packages for

On 17.06.2016 19:57, ????????? ???????? wrote: >>> Then OCSP stapling is the way to go but it could be a real PITA to >>> setup for the first time and may not be supported by older browsers >>> anyway. >>> >> not really, because the same server tells the client that the SSL >> certificate is good, as the SSL certificate itself; >> these must

On 17.06.2016 16:27, ????????? ???????? wrote: > Walter H. ????? 2016-06-16 22:54: >> On 16.06.2016 21:42, ????????? ???????? wrote: >>> >>> I don't think OCSP is critical for free certificates suitable for >>> small businesses and personal sites. >>> >> this is philosophy; >> >> I'd say when you do it then do it good, else

<!doctype html> <html> <head> <meta charset="UTF-8"> </head> <body> <div> <br> </div> <blockquote type="cite"> <div> On 01 May 2018 at 19:03 Felipe Gasper < <a href="mailto:felipe@felipegasper.com">felipe@felipegasper.com</a>> wrote: </div>

Hi I want to create a nice picture about my result of k -the nearest neighbours algorithm. Here is my easy code: ################################# library(klaR) library(ipred) library(mlbench) data(PimaIndiansDiabetes2) dane=na.omit(PimaIndiansDiabetes2)[,c(2,5,9)] dane[,2]=log(dane[,2]) dane[,1:2]=scale(dane[,1:2]) zbior.uczacy=sample(1:nrow(dane),nrow(dane)/2,F)

Hi everybody! I want to find a closer neighbourins observation. This is my code: ########################## library(klaR) library(ipred) library(mlbench) data(PimaIndiansDiabetes2) dane=na.omit(PimaIndiansDiabetes2)[,c(2,5,9)] dane[,2]=log(dane[,2]) dane[,1:2]=scale(dane[,1:2]) zbior.uczacy=sample(1:nrow(dane),nrow(dane)/2,F)

On 16.06.2016 21:42, ????????? ???????? wrote: >> that is right, but hink of your potential clients, because >> wosign has a problem - slow OCSP, ... >> because their server infrastucture is located in China, and not the >> best bandwidth ... >> >> when validity checks of the used SSL certificate very probable fail, >> it is worse than not using SSL ...

Hey all, With google-earth-stable.x86_64 0:7.1.2.2041-0 [mlapier at peach /]$ /usr/bin/google-earth [0425/000212:ERROR:net_util.cc(2195)] Not implemented reached in bool net::HaveOnlyLoopbackAddresses() Failed to load "/opt/google/earth/free/libinput_plugin.so" because "/usr/lib64/libstdc++.so.6: version `GLIBCXX_3.4.14' not found (required by ./libLeap.so)"

Hi, is there a plan to support TLS OCSP stapling in the near future? Regards Torsten -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 819 bytes Desc: OpenPGP digital signature URL: <http://dovecot.org/pipermail/dovecot/attachments/20150426/c30801b6/attachment.sig>