Subject: RE: Certificates: self-signed vs VeriSign

From: "Briley, Robert" <[email-masked]>
Date: Sun, 1 Oct 2000 13:18:31 -0400

I'm not sure that it matters.  We are just trying to establish a consistent
set of business procedures.  As Erin Williams stated earlier "it is very
important to establish "good practices" for using self-signed certificates".
For us, what kind of certs we use are not as important as using them
properly and consistently.
 
Rob
 
Robert Briley
Senior Network Engineer
BridgePoint, Inc.
[email-masked] <mailto:[email-masked]> 

-----Original Message-----
From: Shan Harter [mailto:[email-masked]]
Sent: Saturday, September 30, 2000 7:37 PM
To: Briley, Robert; [email-masked]
Subject: RE: Certificates: self-signed vs VeriSign

Does it really matter if its VeriSign or by Cyclone, or IDX or ECXpert,
Priminos/Templar. As long at the trust relationship between the two parties
has been agreed upon? 

Vcommerce will probably use IDX's generated certificates (AKA Cyclone). 

Shan 

-----Original Message----- 
From: Briley, Robert [ mailto:[email-masked]
<mailto:[email-masked]> ] 
Sent: Friday, September 29, 2000 8:20 AM 
To: [email-masked] 
Subject: RE: Certificates: self-signed vs VeriSign 

As we start to pole our trading partners on their certificate preference, 
the mix is about split.  However, when we ask them the reason behind their 
preference, they don't usually have an explanation other than "well that 
just seemed to be the best way". 

Rob 

Robert Briley 
Senior Network Engineer 
BridgePoint, Inc. 
[email-masked] 

> -----Original Message----- 
> From: Eric D. Williams [SMTP:[email-masked]] 
> Sent: Friday, September 29, 2000 9:25 AM 
> To:   [email-masked] 
> Cc:   'Totman, Philip PL' 
> Subject:      RE: Certificates:  self-signed vs VeriSign 
> 
> -----BEGIN PGP SIGNED MESSAGE----- 
> Hash: SHA1 
> 
> Hello all, 
> I agree with Philip, however the use of self-signed will (in the short 
> term) be 
> limited to those "trading partners" who choose to operate in that 
> modality.  I 
> believe most will be motivated as EDIINT moves forward to choose 
> externally 
> signed certs.  I am sure the current CA's will follow these developments 
> closely and move quickly and deploy services in that space. 
> 
> - From that prospective, however, it is very important to establish "good 
> practices" for using self-signed certificates NOW, regardless of the 
> marketplace developments.  I would be interested in some discussion on the

> 
> parameters (read legal framework) trading partners will establish for that

> type 
> of activity, this will at least give us some practices to draw from 
> concerning 
> self-signing and authenticity. 
> 
> Eric Williams, Pres. 
> Information Brokers, Inc.    Phone: +1 202.889.4395 
> http://www.infobro.com/ <http://www.infobro.com/>         Fax: +1
202.889.4396 
>               mailto:[email-masked] <mailto:[email-masked]>  
>            For More Info: [email-masked] 
>                     PGP Public Key 
>    http://new.infobro.com/KeyServ/EricDWilliams.asc
<http://new.infobro.com/KeyServ/EricDWilliams.asc>  
> Finger Print: 1055 8AED 9783 2378 73EF  7B19 0544 A590 FF65 B789 
> 
> 
> On Friday, September 29, 2000 12:55 AM, Totman, Philip PL 
> [SMTP:[email-masked]] wrote: 
> > Mark, 
> > BHP Steel Australia are about to embark on rolling out an EDIINT 
> compliant 
> > product to its major trading partners. BHP is commited to Sterling 
> Commerce 
> > solutions (Gentran) and have chosen the Internet Data Exchange (IDX) 
> product 
> > that has been sourced from Cyclone. 
> > 
> > We are planning to generate self-signed certificates and we expect that 
> most 
> > trading partners will be happy to follow suit until this type of EDI 
> trading 
> > develops and requires external certificate management. 
> > 
> > regards 
> > 
> > Philip Totman 
> > __________________________________________________ 
> > CSC Technology Services (formerly BHP IT) 
> > CSC 
> > 151 King Street, Warrawong NSW 2502 
> > Ph: (02) 4275 5436   Email: [email-masked] 
> > 
> > 
> > 
> > > ---------- 
> > > From:     [email-masked][SMTP:[email-masked]] 
> > > Sent:     Friday, 29 September 2000 7:04 
> > > To:       [email-masked] 
> > > Cc:       [email-masked]; [email-masked] 
> > > Subject:  Certificates:  self-signed vs VeriSign 
> > > 
> > > Folks, 
> > > 
> > > We're just getting started with EDIINT and we're trying to get a sense

> for 
> > > whether other 
> > > companies are using self-signed certificates or certificates from a CA

> such 
> > > as VeriSign. 
> > > 
> > > What seems to be the trend out there?  Would people look askance at 
> > > self-signed certificates? 
> > > 
> > >     Mark 
> > > 
> > > 
> > EOM 
> > 
> > NOTICE - This message contains information intended only for the use of 
> the 
> > addressee named above.  It may also be confidential and/or privileged. 
> If 
> > you are not the intended recipient of this message you are hereby 
> notified 
> > that you must not disseminate, copy or take any action in reliance on 
> it.  If 
> > you have received this message in error please notify 
> [email-masked]. 
> -----BEGIN PGP SIGNATURE----- 
> Version: PGP 6.5.8 
> 
> iQA/AwUBOdSYKAVEpZD/ZbeJEQJCBQCgrpdp65PmqxAlrZeFeWqK+jy4SEcAn1ev 
> 4P3ZmJjGP9piZRpZnUXsOro3 
> =BrJV 
> -----END PGP SIGNATURE-----

---

From: Dave Roberts <[email-masked]>
Date: Mon, 2 Oct 2000 15:23:00 +0100 (BST)

Sometimes this issue is dictated by the security requirements between
Trading Partners, and the infrastructure between them.

Obviously certificates that are signed by a globally recognised CA are
safe to be transmitted across the Internet to your TP, providing that they
have a good copy of the CA's own certificate.

If you have a means of easily transferring the certificates offline, so
that they cannot be intercepted (or you can verbally verify the
certificate fingerprint), then the use of self-signed certificates, or
certificates signed by an internal CA would be suitable.  All this depends
on the level of security that you are trying to implement. 

As with most things, there is no single best option.

- Dave.

--
Dave Roberts                     Servicing the Online Organisation
Principal Technical Consultant   http://www.saaconsultants.com/
SAA Consultants Ltd              Tel: +44 1752 606000 
Plymouth, UK.                    Fax: +44 1752 606838