<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important">I think it's valuable for CABForum documents to explicitly call out deviations from RFC5280, but I'd take a different approach to Bruce's suggestion...</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
In the Server Certificate BRs, "Application of RFC 5280" describes a scenario (Precertificates) where RFC5280 does
<u>not</u> apply at all; whereas w<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">hat I think we're trying to do here is specify that RFC5280
</span><u style="font-size: 12pt; font-style: inherit; font-variant-ligatures: inherit; font-variant-caps: inherit; font-weight: inherit;">does</u><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;"> apply
(to CRLs) except for one required deviation (i.e., "revocationDate" MUST match the RFC5280 semantics for Invalidity Date, rather than necessarily be "</span><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">The
date on which the </span><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">revocation occurred"</span><span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">).
Deviation is not "Application", in my view.</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I think the most similar concept in the Server Certificate BRs is the language about non-critical Name Constraints:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<div style="margin:0px;font-size:12pt"><i>"Non$B!>(Bcritical Name Constraints are an exception to RFC 5280 (4.2.1.10), however, they MAY be used until</i>
<div style="margin:0px"><i>the Name Constraints extension is supported by Application Software Suppliers whose software is used by</i></div>
<i>a substantial portion of Relying Parties worldwide."<br>
</i></div>
<span style="color: rgb(0, 0, 0); font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt;">The effect of this text is that RFC5280
<u>does</u> apply (to the Name Constraints extension) except for one required deviation (i.e., we permit the extension to be non-critical, at least for now).</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
How about adding this language to the ballot...</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<i>'Permitting the "revocationDate" to be set earlier than the date on which the revocation occurred is an exception to RFC 5280 (5.1.2.6)."</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<i><br>
</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Or, if we're hoping that this RFC5280 deviation will be temporary, how about...</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<i style="background-color:rgb(255, 255, 255)">'Permitting the "revocationDate" to be set earlier than the date on which the revocation occurred is an exception to RFC 5280 (5.1.2.6); however, this MAY be done until the Invalidity Date extension is supported
by Application Software Suppliers whose software is used by a substantial portion of Relying Parties worldwide."</i></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255)"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255)">WDYT?</span></div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> Cscwg-public <cscwg-public-bounces@cabforum.org> on behalf of Bruce Morton via Cscwg-public <cscwg-public@cabforum.org><br>
<b>Sent:</b> 21 September 2021 16:04<br>
<b>To:</b> Corey Bonnell <Corey.Bonnell@digicert.com>; cscwg-public@cabforum.org <cscwg-public@cabforum.org><br>
<b>Subject:</b> Re: [Cscwg-public] CRL Revocation Date Clarification Pre-Ballot</font>
<div> </div>
</div>
<div lang="EN-US" style="word-wrap:break-word">
<p></p>
<div style="background-color:#FAFA03; width:100%; border-style:solid; border-color:#000000; border-width:1pt; padding:2pt; font-size:10pt; line-height:12pt; font-family:'Calibri'; color:Black; text-align:left">
<span style="color:000000">CAUTION:</span> This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.</div>
<br>
<p></p>
<div>
<div class="x_WordSection1">
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Hi Corey,</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
I was thinking that we would create a section similar to the BRs called $B!H(BApplication of RFC 5280.$B!I(B We could have text that says, $B!H(BFor the purposes of clarification, the revocationDate MAY be set the same as the invalidityDate, which would mean that the revocationDate
may precede the date of issue of earlier CRLs.$B!I(B</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
I don$B!G(Bt think that we need to address or change the requirements for invalidityDate as this date is not used by Windows; however, it may be used by other applications per RFC 5280.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Bruce.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
<b>From:</b> Corey Bonnell <Corey.Bonnell@digicert.com> <br>
<b>Sent:</b> Tuesday, September 21, 2021 8:45 AM<br>
<b>To:</b> Bruce Morton <Bruce.Morton@entrust.com>; cscwg-public@cabforum.org<br>
<b>Subject:</b> [EXTERNAL] RE: CRL Revocation Date Clarification Pre-Ballot</p>
</div>
</div>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
WARNING: This email originated outside of Entrust.<br>
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.</p>
<div class="x_MsoNormal" align="center" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Hi Bruce,</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
I interpreted Ian$B!G(Bs message from last week [1] as guidance that all CAs should be using the revocationDate to denote when the Code Signing Certificate is first invalid. Since Windows (Authenticode) does not consume the invalidityDate extension value when making
trust decisions, there is a negative security impact when CAs set the invalidityDate and revocationDate in the manner described in RFC 5280. This ballot codifies the guidance Ian shared so that the revocationDate is set uniformly across all CAs.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Thanks,</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Corey</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
[1] <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fpipermail%2Fcscwg-public%2F2021-September%2F000532.html&data=04%7C01%7Crob%40sectigo.com%7C0d12b84938cc4d7ed05208d97d1118a7%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C637678334657724301%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=0y8EPWbaEx8JjusdPkaCY%2F6AZTmk3mzEJxeQuPv5yhk%3D&reserved=0" originalsrc="https://lists.cabforum.org/pipermail/cscwg-public/2021-September/000532.html" shash="H8CpBHXfBC57qiSUWHDkHF2fKg/0vFKs09VXWFu5LRLWXlgoR9/k+ZQZ5w2C//zadiipvpL72mGF7CqmDxf8xcFa9fR+bSIvFj3gF71RzA/+GHQNvW4e8ugHWsdnBx3C4K90kwf++vbvg+IX5vwVE11MRVdZ2xmbe81HO1lWBis=">
https://lists.cabforum.org/pipermail/cscwg-public/2021-September/000532.html</a></p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
<b>From:</b> Bruce Morton <<a href="mailto:Bruce.Morton@entrust.com">Bruce.Morton@entrust.com</a>>
<br>
<b>Sent:</b> Monday, September 20, 2021 2:31 PM<br>
<b>To:</b> Corey Bonnell <<a href="mailto:Corey.Bonnell@digicert.com">Corey.Bonnell@digicert.com</a>>;
<a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a><br>
<b>Subject:</b> RE: CRL Revocation Date Clarification Pre-Ballot</p>
</div>
</div>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Hi Corey,</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Is there a reason that we cannot allow CAs to continue to use Revocation date and Invalidity date as per RFC 5280?</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
My assumption is that we were going to allow the Revocation date to be a date earlier than the time the certificate was revoked. I am not seeing how this change would impact the Invalidity date.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Bruce.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
<b>From:</b> Cscwg-public <<a href="mailto:cscwg-public-bounces@cabforum.org">cscwg-public-bounces@cabforum.org</a>>
<b>On Behalf Of </b>Corey Bonnell via Cscwg-public<br>
<b>Sent:</b> Monday, September 20, 2021 12:52 PM<br>
<b>To:</b> <a href="mailto:cscwg-public@cabforum.org">cscwg-public@cabforum.org</a><br>
<b>Subject:</b> [EXTERNAL] [Cscwg-public] CRL Revocation Date Clarification Pre-Ballot</p>
</div>
</div>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
WARNING: This email originated outside of Entrust.<br>
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.</p>
<div class="x_MsoNormal" align="center" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Hello,</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
As discussed last week, it would be valuable to ensure that there is clarity regarding how revocation/invalidity dates are encoded in CRLs so that relying party software can make the correct trust decisions regarding compromised code. Attached is a small change
to 13.2.1 to reflect that the revocationDate CRL entry field shall be used to denote when a certificate is invalid. The proposed language allows for the Invalidity Date CRL entry extension to continue to appear, but the time encoded in it must be the same
as the revocationDate for the entry. I don$B!G(Bt believe this causes issues with Windows CRL processing, please let me know if it does and I$B!G(Bll remove the provision.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
For reference, here are the two proposed paragraphs to be added to 13.2.1:</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:10.0pt; font-family:"Courier New"">If a Code Signing Certificate is revoked, and the CA later becomes aware of a more appropriate revocation date, then the CA MAY use that revocation date in subsequent CRL entries and OCSP responses for
that Code Signing Certificate.</span></p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:10.0pt; font-family:"Courier New""> </span></p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
<span style="font-size:10.0pt; font-family:"Courier New"">Effective 2022-02-01, if the CA includes the Invalidity Date CRL entry extension in a CRL entry for a Code Signing Certificate, then the time encoded in the Invalidity Date CRL extension SHALL be equal
to the time encoded in the revocationDate field of the CRL entry.</span></p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Given that the revocation date is potentially security sensitive, I think it$B!G(Bs worthwhile to get this clarified prior to the RFC 3647/Pandoc effort. In addition to comments/questions on the proposed language, we$B!G(Bre looking for two endorsers.</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Thanks,</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
Corey</p>
<p class="x_MsoNormal" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">
<i>Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the
information it contains. <u>Please notify Entrust immediately</u> and delete the message from your system.</i>
</p>
</div>
</div>
</div>
</div>
</body>
</html>