<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle24
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle25
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>I believe you mean MDCs. No one is trying to outlaw SANs. In fact, all certs are SANs certs since subject alternative names are required under the baseline requirements. I disagree that OV is required in almost any case: <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>For example, a DV cert could contain:<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Example.com<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Mail.example.com<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Domain.example.com<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Secure.example.com <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Similarly, an MDC containing the following domain names would not require subject identity vetting:<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Paypal.com<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Ebay.com<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Nothing would prevent separate DV certs from being issued to:<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>DigiCert.com<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Trendmicro.com<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Symantec.com<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Thanks,<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Jeremy<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>kirk_hall@trendmicro.com<br><b>Sent:</b> Friday, November 16, 2012 11:06 AM<br><b>To:</b> Steve Roylance<br><b>Cc:</b> 'CABForum Management'; public@cabforum.org<br><b>Subject:</b> Re: [cabfpub] [cabfman] Ballot 92 - Subject Alternative Names<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='color:#1F497D'>The only way a CA could comply with your rules would be to do an OV authentication for every customer before deciding whether or not to issue a DV SANs cert. That’s pretty much the same as outlawing DV SANs certs<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Steve Roylance <a href="mailto:[mailto:steve.roylance@globalsign.com]">[mailto:steve.roylance@globalsign.com]</a> <br><b>Sent:</b> Friday, November 16, 2012 9:33 AM<br><b>To:</b> Kirk Hall (RD-US)<br><b>Cc:</b> 'CABForum Management'; <a href="mailto:public@cabforum.org">public@cabforum.org</a><br><b>Subject:</b> Re: [cabfman] [cabfpub] Ballot 92 - Subject Alternative Names<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>Kirk,<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>It is NOT meant to prohibit all types of DV SANs<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>It is meant to prohibit DV SANs under certain conditions i.e. where non unique information is contained, or Public IPs are used, or there is a mixture of owners as detailed by the domain registration.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>If you own <b>kirk.com</b> and <b>finewineexpert.com</b> then you can have both inside if they are registered to you.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>Please read the text again carefully and highlight which situation you specifically don't agree with and why you feel it's acceptable to continue.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>Steve<o:p></o:p></span></p></div></div></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='color:black'>From: </span></b><span style='color:black'>"<a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a>" <<a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a>><br><b>Date: </b>Friday, 16 November 2012 17:24<br><b>To: </b>CABForum Management <<a href="mailto:management@cabforum.org">management@cabforum.org</a>>, "<a href="mailto:public@cabforum.org">public@cabforum.org</a>" <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br><b>Subject: </b>Re: [cabfman] [cabfpub] Ballot 92 - Subject Alternative Names<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div><div><p class=MsoPlainText><span style='color:black'>To help members evaluate Ballot 92 we are attaching a side-by-side comparison of current Baseline Requirements language with the proposed new language. As before, the intent of this ballot is to prohibit DV SANs certificates, which we will oppose.<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'> <o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'>Trend Micro does not issue DV certificates, but we think they serve a valuable security function in increasing the use of SSL. Forcing customers to buy OV certs instead is anti-competitive and will likely lead to less use of SSL to secure sites.<o:p></o:p></span></p></div></div><table class=MsoNormalTable border=0 cellpadding=0><tr><td style='background:white;padding:.75pt .75pt .75pt .75pt'><table class=MsoNormalTable border=0 cellpadding=0><tr><td style='padding:.75pt .75pt .75pt .75pt'><pre>TREND MICRO EMAIL NOTICE<o:p></o:p></pre><pre>The information contained in this email and any attachments is confidentialand may be subject to copyright or other intellectual property protection.<o:p></o:p></pre><pre>If you are not the intended recipient, you are not authorized to use or<o:p></o:p></pre><pre>disclose this information, and we request that you notify us by reply mail or<o:p></o:p></pre><pre>telephone and delete the original message from your mail system.<o:p></o:p></pre></td></tr></table></td></tr></table><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>_______________________________________________ Management mailing list <a href="mailto:Management@cabforum.org">Management@cabforum.org</a> <a href="https://cabforum.org/mailman/listinfo/management">https://cabforum.org/mailman/listinfo/management</a> <o:p></o:p></span></p><table class=MsoNormalTable border=0 cellpadding=0><tr><td style='background:white;padding:.75pt .75pt .75pt .75pt'><table class=MsoNormalTable border=0 cellpadding=0><tr><td style='padding:.75pt .75pt .75pt .75pt'><pre><o:p> </o:p></pre><pre>TREND MICRO EMAIL NOTICE<o:p></o:p></pre><pre>The information contained in this email and any attachments is confidential <o:p></o:p></pre><pre>and may be subject to copyright or other intellectual property protection. <o:p></o:p></pre><pre>If you are not the intended recipient, you are not authorized to use or <o:p></o:p></pre><pre>disclose this information, and we request that you notify us by reply mail or<o:p></o:p></pre><pre>telephone and delete the original message from your mail system.<o:p></o:p></pre></td></tr></table></td></tr></table><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p></div></body></html>