> I question the legal enforceability of such "licensing schemes" since
> in reality, the CA is not actually selling you a certificate. They
> are, in effect, simply signing a certificate that was created by the
> certificate holder, endorsing the validity of the data in the
> certificate. As to how the certificate is used, the certificate is
> not the property of the CA, and O would think that they could have no
> legal say as to its use.
>
> There is, of course, nothing in the certificate itself that would
> prevent its use on multiple machines or IP Addresses, or restricted to
> a number of "subdomains."
Correct.
> I could be wrong, but it would be interesting to get a legal opinion
> on this.
That would be nice.
> Usage restrictions are really a sign of how stupid and greedy the
> certificate industry is getting IMO, and I don't exempt any of the
> CA's from that criticism.
Thawte's official published excuse for their new license scheme:
"Many customers are becoming increasingly concerned about the possible
implications of using an unlicensed product. In light of this, Thawte has
taken the decision to sell its wildcard certificates on a licensing basis.
The new licensed wildcard not only enables you to continue to reap the
inherent benefits of using a wildcard certificate, it also provides you
with peace of mind of knowing the boundaries within which you are legally
entitled to use the certificate."
I'm sure most of us are pretty certain all of their decisions are based on
their parents greed. After all, that's why Verisign bought Thawte in the
first place.
This archive was generated by hypermail 2.1.3 : Tue Oct 19 2004 - 23:37:20 EDT