<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hi,<br>
<br>
SSC votes: "Abstain".<br>
<br>
Thanks,<br>
M.D.<br>
<br>
On 2/5/2013 11:39 PM, Jeremy Rowley wrote:<br>
</div>
<blockquote cite="mid:048c01ce03e9$401ba560$c052f020$@digicert.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=ISO-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
p.line874, li.line874, div.line874
{mso-style-name:line874;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.line862, li.line862, div.line862
{mso-style-name:line862;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<div
style="mso-element:para-border-div;border:none;border-bottom:solid
windowtext 1.0pt;padding:0in 0in 1.0pt 0in">
<p class="MsoNormal" style="border:none;padding:0in">Hi
everyone, <o:p></o:p></p>
<p class="MsoNormal" style="border:none;padding:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="border:none;padding:0in">This is
the formal ballot on wildcards and gTLDs. This ballot will
require the uniform use of wildcard characters in
certificates and initiate an early phase-out of gTLDs
approved by ICANN. Once passed, CAs will need to stop
issuing certificates with the new gTLDs and revoke them 120
days after ICANN has signed an agreement with the gTLD
operator. If the ballot is approved, the [<a class="moz-txt-link-abbreviated" href="http://www.icann.org">www.icann.org</a>]
references in the ballot will be replaced with a link
provided by ICANN that all CAs can use to check for approved
gTLDs.<o:p></o:p></p>
<p class="MsoNormal" style="border:none;padding:0in"><o:p> </o:p></p>
<p class="MsoNormal" style="border:none;padding:0in">Thanks,<o:p></o:p></p>
<p class="MsoNormal" style="border:none;padding:0in">Jeremy<o:p></o:p></p>
<p class="MsoNormal" style="border:none;padding:0in"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Jeremy Rowley made the following motion,
and Rick Andrews and Steve Roylance endorsed it:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">... Motion Begins ...<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">... Erratum Begins ...<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Add the following as new Section 11.1.3:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">11.1 Authorization by Domain Name
Registrant <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">11.1.3 Wildcard Domain Validation<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Before issuing a certificate with a
wildcard character (*) in a CN or subjectAltName of type
DNS-ID, the CA MUST establish and follow a documented
procedure† that determines if the wildcard character occurs in
the first label position to the left of a
“registry-controlled” label or “public suffix” (e.g. “*.com”,
“*.co.uk”, see RFC 6454 Section 8.2 for further explanation).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If a wildcard would fall within the label
immediately to the left of a registry-controlled† or public
suffix, CAs MUST refuse issuance unless the applicant proves
its rightful control of the entire Domain Namespace. (e.g. CAs
MUST NOT issue “*.co.uk” or “*.local”, but MAY issue
“*.example.com” to Example Co.). <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Prior to September 1, 2013, each CA MUST
revoke any valid certificate that does not comply with this
section of the Requirements.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">†Determination of what is
“registry-controlled” versus the registerable portion of a
Country Code Top-Level Domain Namespace is not standardized at
the time of writing and is not a property of the DNS itself.
Current best practice is to consult a “public suffix list”
such as <a class="moz-txt-link-freetext" href="http://publicsuffix.org/">http://publicsuffix.org/</a>. If the process for making
this determination is standardized by an RFC, then such a
procedure SHOULD be preferred.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Add the following as new Section 11.1.4:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">11.1.4 New gTLD Domains<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">CAs SHOULD NOT issue Certificates
containing a new gTLD under consideration by ICANN. Prior to
issuing a Certificate containing an Internal Server Name with
a gTLD that ICANN has announced as under consideration to make
operational, the CA MUST provide a warning to the applicant
that the gTLD may soon become resolvable and that, at that
time, the CA will revoke the Certificate unless the applicant
promptly registers the domain name. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Within 30 days after ICANN has approved a
new gTLD for operation, as evidenced by publication of a
contract with the gTLD operator on [<a class="moz-txt-link-abbreviated" href="http://www.icann.org">www.icann.org</a>] each CA
MUST (1) compare the new gTLD against the CA’s records of
valid certificates and (2) cease issuing Certificates
containing a Domain Name that includes the new gTLD until
after the CA has first verified the Subscriber's control over
or exclusive right to use the Domain Name in accordance with
Section 11.1.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Within 120 days after the publication of a
contract for a new gTLD is published on [<a class="moz-txt-link-abbreviated" href="http://www.icann.org">www.icann.org</a>], CAs
MUST revoke each Certificate containing a Domain Name that
includes the new gTLD unless the Subscriber is either the
Domain Name Registrant or can demonstrate control over the
Domain Name.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">... Erratum Ends ...<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The review period for this ballot shall
commence at 21:00 UTC on 6 February 2013 and will close at
21:00 UTC on 13 February 2013. Unless the motion is withdrawn
during the review period, the voting period will start
immediately thereafter and will close at 21:00 UTC on 20
February 2013. Votes must be cast by posting an on-list reply
to this thread. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">... Motions ends ... <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">A vote in favor of the motion must indicate
a clear 'yes' in the response. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">A vote against must indicate a clear 'no'
in the response. A vote to abstain must indicate a clear
'abstain' in the response. Unclear responses will not be
counted. The latest vote received from any representative of a
voting member before the close of the voting period will be
counted. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Voting members are listed here:
<a class="moz-txt-link-freetext" href="http://www.cabforum.org/forum.html">http://www.cabforum.org/forum.html</a> <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In order for the motion to be adopted, two
thirds or more of the votes cast by members in the CA category
and one half or more of the votes cast by members in the
browser category must be in favor. Also, at least seven
members must participate in the ballot, either by voting in
favor, voting against or abstaining.<o:p></o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<br>
</body>
</html>