Subject: [stir] Implications of using the web PKI

From: Richard Barnes <[email-masked]>
Date: Thu, 7 Apr 2016 17:02:19 -0300

Hey all,

I mentioned in the meeting the other day that there can be some negative
implications of re-using WebPKI certs.  Payment processors have been using
WebPKI certificates for servers that payment terminals talk to.  These
terminals only support the obsolete SHA-1 algorithm, which is now forbidden
by the CABF Baseline Requirements.  So those payment processors have had to
ask the browsers for permission just to keep their payment terminals
operating.

As though on call, a new instance of this problem cropped up this morning:

https://cabforum.org/pipermail/public/2016-April/007182.html

Those advocating for reuse of WebPKI certificates should imagine whether we
want telcos in this position next time.

--Richard