<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",serif;
mso-ligatures:standardcontextual;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#467886" vlink="#96607D" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:11.0pt'>Attendees:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Abhishek Bhat (eMudhra), Ben Dewberry (Keyfactor), Brianca Martin (Amazon), Bruce Morton (Entrust), Corey Bonnell (DigiCert), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Ian McMillan (Microsoft), Inaba Atsushi (GlobalSign), Inigo Barreira (Sectigo), Keshava Nagaraju (eMudhra), Mohit Kumar (GlobalSign), Richard Kisley (IBM), Scott Rea (eMudhra), Thomas Zermeno (SSL.com)<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Dean read the note well.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Meeting minutes for January 25th meeting were approved.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Import EVG references into CSBRs<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Dimitris gave status update for removing references to EVGs. A mapping spreadsheet was provided on the list to facilitate comparison. Dimitris gave the group a walkthrough of the document. Dimitris added the organizationIdentifier field, as it's in the EVGs but not the CSBRs.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Bruce said that introducing the orgId attribute is a change to the profile and should be a separate document. Dimitris proposed that he will circulate a diff of EVG 1.7.2 and 1.8.0 so the group can compare the differences in normative requirements between the versions.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Timestamping<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Bruce said that Martijn has a ballot proposal on Github. Ian would like to halve the maximum validity of the end-entity timestamp certificate. Bruce said the motivation of requiring key destruction is that long-lived timestamp certificates are not a risk if the private key material is destroyed.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Also, a long-lived certificate provides interoperability with other ecosystems, such as Java. Ian said that long-lived certificates might be a burden for CAs in providing OCSP responses for potentially several decades. Bruce said that we can raise this point as feedback to the ballot.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>F2F discussion<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Dean said that the February 22nd meeting is cancelled. Dean asked the group for topics to discuss.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Ian provided these topics:<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>1. Certificate transparency requirements for code signing certificates. Which activities that are logged (issuance, revocation) would be good to discuss. Also, which monitors are needed in the ecosystem?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>2. Reduction of code signing certificate validity to 15 months<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Bruce called for additional topics for the F2F. Dimitris said he will prepare the import of the EVGs for presentation at the F2F.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt'>Meeting adjourned. Next meeting is at the F2F; the February 22nd meeting is cancelled.<o:p></o:p></span></p></div></body></html>