<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); "><div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><font face="Arial" style="font-size: 12px;">H</font><font face="Arial"><span style="font-size: 12px;">i Rick,</span></font></div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><font face="Arial" style="font-size: 12px;"><br></font></div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><span style="font-family: Arial; font-size: 12px; ">I'd agree with you if a CA only placed dNSNames or rfc822Names into the permitted constraints but adding directoryNames as Rob said, means that audits are not required as the CA has already done the work to close the holes.</span></div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><font face="Arial" style="font-size: 12px;"><br></font></div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><font face="Arial" style="font-size: 12px;">e.g.</font></div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><font face="Arial" style="font-size: 12px;"><b>Permitted Subtrees =</b></font></div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><blockquote style="margin:0 0 0 40px; border:none; padding:0px;"><div><b><font face="Arial" style="font-size: 12px;">dnsNames</font></b></div><div><font face="Arial" style="font-size: 12px;"><span class="Apple-tab-span" style="white-space:pre"> </span>example.com</font></div><div><b><font face="Arial" style="font-size: 12px;">rfc822names</font></b></div><div><font face="Arial" style="font-size: 12px;"><span class="Apple-tab-span" style="white-space:pre"> </span>example.com</font></div><div><b><font face="Arial" style="font-size: 12px;">directoryName</font></b></div><div><font face="Arial" style="font-size: 12px;"><span class="Apple-tab-span" style="white-space:pre"> </span>O=Example Inc</font></div><div><font face="Arial" style="font-size: 12px;"><span class="Apple-tab-span" style="white-space:pre"> </span>L= Locality</font></div><div><font face="Arial" style="font-size: 12px;"><span class="Apple-tab-span" style="white-space:pre"> </span>S= State</font></div><div><font face="Arial" style="font-size: 12px;"><span class="Apple-tab-span" style="white-space:pre"> </span>C=Country</font></div></blockquote></div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><font face="Arial" style="font-size: 12px;"><br></font></div><div style="font-family: Calibri, sans-serif; font-size: 14px; ">I don't think you were in the Forum when we met in Paris and discussed the best way to cover all the possibilities of how a certificate could be issued and therefore mis issued. Please see attached PPT which shows these. Each case was later reflected in Base Requirements 1.0. Admittedly we didn't pare this down further into dNSNames and directoryNames but that would have been most peoples understanding to remove many of the loop holes in letting third parties have a hand in validation processes. </div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><br></div><div style="font-family: Calibri, sans-serif; font-size: 14px; ">I'm happy to work with you to ensure there's language in the BRs to make sure this is clear.</div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><br></div><div style="font-family: Calibri, sans-serif; font-size: 14px; ">Oh and if anyone wants anything explaining in my diagrams (As they may be a little confusing the first time around) then let me know.</div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><font face="Arial" style="font-size: 12px;"><br></font></div><div><div><font face="Arial"><span style="font-size: 12px;">Happy holidays!!</span></font></div><div><font face="Arial"><span style="font-size: 12px;"><br></span></font></div><div><font face="Arial"><span style="font-size: 12px;">Steve</span></font></div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><font class="Apple-style-span" style="font-family: Arial, sans-serif; font-size: 12px; "><font class="Apple-style-span"><p class="MsoNormal" style="font-size: 14px; margin: 0cm 0cm 0.0001pt; font-family: Calibri, sans-serif; line-height: 17px; "><span style="line-height: 5px; font-family: Arial; "><o:p><font class="Apple-style-span" size="3"><span class="Apple-style-span" style="font-size: 12px; "> </span></font></o:p></span></p><p class="MsoNormal" style="font-size: 14px; margin: 0cm 0cm 0.0001pt; font-family: Calibri, sans-serif; line-height: 17px; "><br></p></font></font><p></p><font class="Apple-style-span"><p style="font-family: Arial, sans-serif; "></p></font></div></div></div><div style="font-family: Calibri, sans-serif; font-size: 14px; "><br></div><span id="OLK_SRC_BODY_SECTION" style="font-family: Calibri, sans-serif; font-size: 14px; "><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> Rick Andrews <<a href="mailto:Rick_Andrews@symantec.com">Rick_Andrews@symantec.com</a>><br><span style="font-weight:bold">Date: </span> Friday, 21 December 2012 18:43<br><span style="font-weight:bold">To: </span> "<a href="mailto:public@cabforum.org">public@cabforum.org</a>" <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br><span style="font-weight:bold">Subject: </span> [cabfpub] 17.5 Audit of Delegated Functions<br></div><div><br></div><div><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"><meta name="Generator" content="Microsoft Exchange Server"><!-- converted from rtf --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style><div><font face="Calibri,sans-serif" size="3"><div style="margin-top: 5pt; margin-bottom: 5pt; ">CABF members,</div><div style="margin-top: 5pt; margin-bottom: 5pt; ">It’s come to our attention that several people are interpreting this section of BR:</div><div style="margin-top: 5pt; margin-bottom: 5pt; "><b>17.5 Audit of Delegated Functions</b></div><div><font size="2">If a Delegated Third Party is not currently audited in accordance with Section 17 and is not an Enterprise RA, then</font></div><div><font size="2">prior to certificate issuance the CA SHALL ensure that the domain control validation process required under Section</font></div><div><font size="2">11.1 has been properly performed by the Delegated Third Party by either (1) using an out-of-band mechanism</font></div><div><font size="2">involving at least one human who is acting either on behalf of the CA or on behalf of the Delegated Third Party to</font></div><div><font size="2">confirm the authenticity of the certificate request or the information supporting the certificate request or (2)</font></div><div><font size="2">performing the domain control validation process itself.</font></div><div style="margin-top: 5pt; margin-bottom: 5pt; ">to mean that a Delegated Third Party that runs an External SubCA can avoid audit indefinitely if it simply has a name constraint in the SubCA limiting the domain names that it can issue to. The CA would be
complying with “(2) performing the domain control validation itself” before it put the name constraint in the SubCA.</div><div style="margin-top: 5pt; margin-bottom: 5pt; ">This seems like a loophole to us, because without an audit, there’s no way to be sure that the Delegated Third Party is putting properly vetted info in the Subject DN field, and populating certs with the required
extensions.</div><div style="margin-top: 5pt; margin-bottom: 5pt; ">I doubt this was the intent, because I had the impression that most people thought External SubCAs were a risky practice that needed to be more tightly controlled. This seems to allow them to be less tightly
controlled. Comments?</div><div style="margin-top: 5pt; margin-bottom: 5pt; ">-Rick</div><div><font face="Calibri,sans-serif" size="2"> </font></div><div><font face="Calibri,sans-serif" size="2"> </font></div></font></div></div>
_______________________________________________
Public mailing list
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><a href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a></span></body></html>