diff --git a/CertificationPracticeStatement.html b/CertificationPracticeStatement.html
index e6ad9fc..8b37b15 100755
--- a/CertificationPracticeStatement.html
+++ b/CertificationPracticeStatement.html
@@ -3121,16 +3121,11 @@ Refer to SM3.1 "Logical Security - Network".
-Each server synchronises with NTP.
-No "timestamping" service is currently offered.
+The Signing Server receives the time through the serial link, but the synchronisation has to be done manually by a sysadmin.
+All other servers synchronise with NTP or HTTPDATE.
+CAcert might offer a Timestamping Service, or might approve an existing Timestamping Service.
-
- - How does the signing server syncronise if only connected over serial?
- - How is timestamping done on records?
-
-
-
@@ -3148,7 +3143,6 @@ by the Member or the Non-related Person.
- What versions of PGP are signed? v3? v4?
Issued X.509 certificates are of v3 form.
@@ -3163,18 +3157,16 @@ Client certificates include the following extensions:.
-
basicConstraints=CA:FALSE (critical)
-
- keyUsage=digitalSignature,keyEncipherment,cRLSign
-
-
+ keyUsage=digitalSignature,keyEncipherment
-
extendedKeyUsage=emailProtection,clientAuth,serverAuth,msEFS,msSGC,nsSGC
-
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org
-
- subjectAltName=(as per §3.1.1.).
+ subjectAltName=(as per §3.1.1.) (can be marked critical).
- what about Client Certificates Adobe Signing extensions ?
- - SubjectAltName should become critical if DN is removed http://tools.ietf.org/html/rfc5280#section-4.2.1.6
@@ -3190,7 +3182,7 @@ Server certificates include the following extensions:
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org
- subjectAltName=(as per §3.1.1.).
+ subjectAltName=(as per §3.1.1.) (can be marked critical).
@@ -3205,10 +3197,9 @@ Code-Signing certificates include the following extensions:
extendedKeyUsage=emailProtection,clientAuth,codeSigning,msCodeInd,msCodeCom,msEFS,msSGC,nsSGC
authorityInfoAccess = OCSP;URI:http://ocsp.cacert.org
+
+ subjectAltName=(as per §3.1.1.) (can be marked critical).
-
- - what about subjectAltName for Code-signing
-
OpenPGP key signatures currently do not include extensions.
@@ -3251,7 +3242,7 @@ into certificates:
- 1.3.6.1.4.1.18506.4.4
+ 1.3.6.1.4.1.18506.4.4.1
|
Certification Practice Statement
|