Subject: Certificates: self-signed vs VeriSign

From: [email-masked]
Date: Thu, 28 Sep 2000 16:04:19 -0400

Folks,

We're just getting started with EDIINT and we're trying to get a sense for
whether other
companies are using self-signed certificates or certificates from a CA such
as VeriSign.

What seems to be the trend out there?  Would people look askance at
self-signed certificates?

    Mark

---

From: "Totman, Philip PL" <[email-masked]>
Date: Fri, 29 Sep 2000 15:54:57 +1100

Mark,
BHP Steel Australia are about to embark on rolling out an EDIINT compliant product to its major trading partners. BHP is commited to Sterling Commerce solutions (Gentran) and have chosen the Internet Data Exchange (IDX) product that has been sourced from Cyclone.

We are planning to generate self-signed certificates and we expect that most trading partners will be happy to follow suit until this type of EDI trading develops and requires external certificate management. 

regards

Philip Totman
__________________________________________________
CSC Technology Services (formerly BHP IT)
CSC
151 King Street, Warrawong NSW 2502 
Ph: (02) 4275 5436   Email: [email-masked]

> ----------
> From: 	[email-masked][SMTP:[email-masked]]
> Sent: 	Friday, 29 September 2000 7:04
> To: 	[email-masked]
> Cc: 	[email-masked]; [email-masked]
> Subject: 	Certificates:  self-signed vs VeriSign
> 
> Folks,
> 
EOM 

NOTICE - This message contains information intended only for the use of the addressee named above.  It may also be confidential and/or privileged.  If you are not the intended recipient of this message you are hereby notified that you must not disseminate, copy or take any action in reliance on it.  If you have received this message in error please notify [email-masked].

---

From: "Eric D. Williams" <[email-masked]>
Date: Fri, 29 Sep 2000 09:24:56 -0400

Hello all,
I agree with Philip, however the use of self-signed will (in the short term) be 
limited to those "trading partners" who choose to operate in that modality.  I 
believe most will be motivated as EDIINT moves forward to choose externally 
signed certs.  I am sure the current CA's will follow these developments 
closely and move quickly and deploy services in that space.

- From that prospective, however, it is very important to establish "good 
practices" for using self-signed certificates NOW, regardless of the 
marketplace developments.  I would be interested in some discussion on the 
parameters (read legal framework) trading partners will establish for that type 
of activity, this will at least give us some practices to draw from concerning 
self-signing and authenticity.

Eric Williams, Pres.
Information Brokers, Inc.    Phone: +1 202.889.4395
http://www.infobro.com/        Fax: +1 202.889.4396
              mailto:[email-masked]
           For More Info: [email-masked]
                    PGP Public Key
   http://new.infobro.com/KeyServ/EricDWilliams.asc
Finger Print: 1055 8AED 9783 2378 73EF  7B19 0544 A590 FF65 B789

On Friday, September 29, 2000 12:55 AM, Totman, Philip PL 
[SMTP:[email-masked]] wrote:
> Mark,
> BHP Steel Australia are about to embark on rolling out an EDIINT compliant
> product to its major trading partners. BHP is commited to Sterling Commerce
> solutions (Gentran) and have chosen the Internet Data Exchange (IDX) product
> that has been sourced from Cyclone.
>
> We are planning to generate self-signed certificates and we expect that most
> trading partners will be happy to follow suit until this type of EDI trading
> develops and requires external certificate management.
>
> regards
>
> Philip Totman
> NOTICE - This message contains information intended only for the use of the
> addressee named above.  It may also be confidential and/or privileged.  If
> you are not the intended recipient of this message you are hereby notified
> that you must not disseminate, copy or take any action in reliance on it.  If
> you have received this message in error please notify [email-masked].

---

From: "Briley, Robert" <[email-masked]>
Date: Fri, 29 Sep 2000 11:19:44 -0400

As we start to pole our trading partners on their certificate preference,
the mix is about split.  However, when we ask them the reason behind their
preference, they don't usually have an explanation other than "well that
just seemed to be the best way".

Rob

Robert Briley
Senior Network Engineer
BridgePoint, Inc.
[email-masked]

> -----Original Message-----
> From:	Eric D. Williams [SMTP:[email-masked]]
> Sent:	Friday, September 29, 2000 9:25 AM
> To:	[email-masked]
> Cc:	'Totman, Philip PL'
> Subject:	RE: Certificates:  self-signed vs VeriSign
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Hello all,
> -----BEGIN PGP SIGNATURE-----
> Version: PGP 6.5.8
> 
> iQA/AwUBOdSYKAVEpZD/ZbeJEQJCBQCgrpdp65PmqxAlrZeFeWqK+jy4SEcAn1ev
> 4P3ZmJjGP9piZRpZnUXsOro3
> =BrJV
> -----END PGP SIGNATURE-----

---

From: "Ahmed, Zahid" <[email-masked]>
Date: Sat, 30 Sep 2000 20:15:24 -0700

Depends what type of certificate services we are talking about.
 
If it is SSL Server certificates for internet facing applications, it seems
that we do want to use
a public CA to provide certificate issuance/revocation services.
 
If it is other types of certificates, you could use a private, closed CA;
however, the central issue
here is who provides liability backing for the secure transactions. Are
there any models for
transaction liability between trading partners in the EDI over the internet
world?
 
---Zahid

-----Original Message-----
From: Craig Wilson [mailto:[email-masked]]
Sent: Saturday, September 30, 2000 5:49 PM
To: Shan Harter; 'Briley, Robert'; [email-masked]
Subject: Re: Certificates: self-signed vs VeriSign

Good choice.  Works well for us.  Comes with a freely distributable client
piece for those pesky SME situations.
 
Craig.

----- Original Message ----- 
From: Shan  <mailto:[email-masked]> Harter 
To: 'Briley, Robert' <mailto:[email-masked]>  ;
[email-masked] <mailto:[email-masked]>  
Sent: Saturday, September 30, 2000 7:36 PM
Subject: RE: Certificates: self-signed vs VeriSign

Does it really matter if its VeriSign or by Cyclone, or IDX or ECXpert,
Priminos/Templar. As long at the trust relationship between the two parties
has been agreed upon? 

Vcommerce will probably use IDX's generated certificates (AKA Cyclone). 

Shan 

-----Original Message----- 
From: Briley, Robert [ mailto:[email-masked]
<mailto:[email-masked]> ] 
Sent: Friday, September 29, 2000 8:20 AM 
To: [email-masked] <mailto:[email-masked]>  
Subject: RE: Certificates: self-signed vs VeriSign 

Rob 

Robert Briley 
Senior Network Engineer 
BridgePoint, Inc. 

> 
> parameters (read legal framework) trading partners will establish for that

> type 
> http://www.infobro.com/ <http://www.infobro.com/>         Fax: +1
202.889.4396 
>               mailto:[email-masked] <mailto:[email-masked]>  
<http://new.infobro.com/KeyServ/EricDWilliams.asc>  
> > > We're just getting started with EDIINT and we're trying to get a sense

> for 
> > > whether other 
> > > companies are using self-signed certificates or certificates from a CA

> such