<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 12/23/2015 3:59 PM, John L. Jacobs wrote:<br>
<blockquote cite="mid:567B3558.4060500@jljacobs.com" type="cite">I
do have XP SP2 on my network but rarely even powered up. What I
find difficult to understand is your use of the word "deprecate"
in the context of MS and SHA1. In my experience, SHA1 has pretty
much not be used for quite a while in favor of SHA2 (SHA-256).
Thuderbird (an old version?) is on the XP machine, not being used,
would update, data on it has been irrelevant for a long time. Let
me know what you want are looking for.<br>
<br>
I read into this and other communications that TB is in someway
going to incorporate security certificates???<br>
<meta http-equiv="content-type" content="text/html;
charset=windows-1252">
<font face="Lucida Calligraphy"> <small><small><small> ---<br>
John L Jacobs, Retired Network Engineer<br>
4105 Primrose Way<br>
Napa, Ca 94558-1595<br>
Ph: 415-738-2550<br>
</small></small></small></font></blockquote>
<br>
The immediate issue is the signing of Mozilla code, which is
necessary to prevent security warnings from appearing when Firefox
or Thunderbird is installed. This month, the signing is being
switched from SHA-1 to SHA-256, with that schedule forced up against
a deadline by the upcoming deprecation of SHA-1 in modern Windows
systems on 2016-01-01. The issue is complicated by the Mozilla
installer, that is used for silent updates of Firefox and
Thunderbird. That also had to be upgraded, and the whole thing has
to be done in two steps. (Bit of a chicken and egg problem getting
existing apps, signed with SHA-1, to recognize SHA-256 before
updated versions, signed with SHA-256, could be released.).<br>
<br>
The QA problem is quite tricky, as each version of Microsoft Windows
has a slightly different set of handling of SHA-1 and SHA-256
certificates, plus it depends on both the system date in the client
system, as well as the system date of the certificate-signing
system.<br>
<br>
:rkent<br>
</body>
</html>