<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri, sans-serif" size="2">
<div>As suggested on an earlier call, I’ve handled a lot of the minor issues in this doc and grouped the remaining ones into meta-issues (five of them). I’ll send out emails periodically to have discussion on each. This is the second.</div>
<div> </div>
<div>The issues list and the doc itself can be found on the wiki at <a href="https://www.cabforum.org/wiki/89%20-%20Adopt%20Guidelines%20for%20the%20Processing%20of%20EV%20SSL%20Certificates%20v.2"><font color="#0000FF"><u>https://www.cabforum.org/wiki/89%20-%20Adopt%20Guidelines%20for%20the%20Processing%20of%20EV%20SSL%20Certificates%20v.2</u></font></a></div>
<div> </div>
<div>NOTE that I especially need input from browser vendors. This is your document. </div>
<div> </div>
<div><font face="Times New Roman, serif" size="3"> </font></div>
<div>Meta-Issue #3: The document currently states: <font face="Calibri, sans-serif">"Certificates for which confirmation cannot be obtained should not be granted the EV treatment"</font></div>
<div><font face="Calibri, sans-serif"> </font></div>
<div><font face="Calibri, sans-serif">Brian Smith raised concerns about offline behavior (he wants Firefox to show the EV Treatment in that case). Rick stated that this applies whenever a full SSL handshake is performed. Since no SSL is done in offline mode,
the browser should rely on cached info. If it has cached the certificate and an OCSP response, then it should be able to display the EV Treatment.</font></div>
<div><font face="Calibri, sans-serif"> </font></div>
<div><font face="Calibri, sans-serif">Brian also raised concerns about the EV indicator switching on and off and confusing users. Rick agrees that it might be confusing, but asked what should happen if a later OCSP fetch failed because an attacker was in the
middle or had otherwise changed the certificate to a different one? </font></div>
<div><font face="Times New Roman, serif" size="3"> </font></div>
<div><font face="Times New Roman, serif" size="3"> </font></div>
<div><font face="Calibri, sans-serif">I welcome your comments.</font></div>
<div><font face="Calibri, sans-serif"> </font></div>
<div><font face="Calibri, sans-serif">-Rick</font></div>
<div><font face="Times New Roman, serif" size="3"> </font></div>
<div><font face="Times New Roman, serif" size="3"> </font></div>
</font>
</body>
</html>