Some bits on various aspects of the ipsCA root certificate failure .

First, I've seen comments that the new ipsCA CA rootcertificate should be included in the next update ofFirefox. However, I've now found the Mozilla bug about this (via JeffBallard ), and it makesit seem very unlikely that the root certificate is going to be includedin the near future (especially as ipsCA apparently had problems evenbefore this). Interested people can watch Mozilla's CA:Schedule wikipage .

(

Here is a corollary on how push technology breeds spam : even if you have carefully built a pull based systemthat is thus insulated from spam, you need to carefully take a freshlook at it to see if you have any features that do (implicit) pushactions that could be exploited by clever spammers. You'll probablyhave some push features (because they're useful for your users), inwhich case you need a plan for dealing with spam through them.

To be clear here, by '

I've seen a number of people saying that universities who took advantageof ipsCA 's offer of free SSL certificates foreducational institutions are now getting their money's worth, and thatit clearly would have been better to pay a real SSL CA vendor for realcertificates. Would that it were so simple.

The real attraction of the free ipsCA certificates here (and likely atother universities) was not that they saved you $40 US or so. Their realattraction was that you could get them without