<br><font size=2 face="sans-serif">CERTUM abstains</font>
<br>
<br>
<br>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>"Jeremy Rowley"
<jeremy.rowley@digicert.com></b> </font>
<br><font size=1 face="sans-serif">Wysłane przez: public-bounces@cabforum.org</font>
<p><font size=1 face="sans-serif">2013-02-05 22:39</font>
<table border>
<tr valign=top>
<td bgcolor=white>
<div align=center><font size=1 face="sans-serif">Odpowiedz użytkownikowi<br>
jeremy.rowley@digicert.com</font></div></table>
<br>
<td width=59%>
<table width=100%>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">Do</font></div>
<td><font size=1 face="sans-serif"><public@cabforum.org></font>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">DW</font></div>
<td>
<tr valign=top>
<td>
<div align=right><font size=1 face="sans-serif">Temat</font></div>
<td><font size=1 face="sans-serif">[cabfpub] Ballot 96 - Wildcard Certificates
and New gTLDs</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><font size=3 face="Calibri">Hi everyone, </font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">This is the formal ballot on wildcards
and gTLDs. This ballot will require the uniform use of wildcard characters
in certificates and initiate an early phase-out of gTLDs approved by ICANN.
Once passed, CAs will need to stop issuing certificates with the new gTLDs
and revoke them 120 days after ICANN has signed an agreement with the gTLD
operator. If the ballot is approved, the [www.icann.org] references
in the ballot will be replaced with a link provided by ICANN that all CAs
can use to check for approved gTLDs.</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">Thanks,</font>
<br><font size=3 face="Calibri">Jeremy</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">Jeremy Rowley made the following motion,
and Rick Andrews and Steve Roylance endorsed it:</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">... Motion Begins ...</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">... Erratum Begins ...</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">Add the following as new Section 11.1.3:</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">11.1 Authorization by
Domain Name Registrant </font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">11.1.3 Wildcard Domain Validation</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">Before issuing a certificate with a wildcard
character (*) in a CN or subjectAltName of type DNS-ID, the CA MUST establish
and follow a documented procedure† that determines if the wildcard character
occurs in the first label position to the left of a “registry-controlled”
label or “public suffix” (e.g. “*.com”, “*.co.uk”, see RFC 6454 Section
8.2 for further explanation).</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">If a wildcard would fall within the label
immediately to the left of a registry-controlled† or public suffix, CAs
MUST refuse issuance unless the applicant proves its rightful control of
the entire Domain Namespace. (e.g. CAs MUST NOT issue “*.co.uk” or “*.local”,
but MAY issue “*.example.com” to Example Co.). </font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">Prior to September 1, 2013, each CA MUST
revoke any valid certificate that does not comply with this section of
the Requirements.</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">†Determination of what is “registry-controlled”
versus the registerable portion of a Country Code Top-Level Domain
Namespace is not standardized at the time of writing and is not a property
of the DNS itself. Current best practice is to consult a “public suffix
list” such as http://publicsuffix.org/. If the process for making
this determination is standardized by an RFC, then such a procedure SHOULD
be preferred.</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">Add the following as new Section 11.1.4:</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">11.1.4 New gTLD Domains</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">CAs SHOULD NOT issue Certificates containing
a new gTLD under consideration by ICANN. Prior to issuing a Certificate
containing an Internal Server Name with a gTLD that ICANN has announced
as under consideration to make operational, the CA MUST provide a warning
to the applicant that the gTLD may soon become resolvable and that, at
that time, the CA will revoke the Certificate unless the applicant promptly
registers the domain name. </font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">Within 30 days after ICANN has approved
a new gTLD for operation, as evidenced by publication of a contract
with the gTLD operator on [www.icann.org] each CA MUST (1) compare the
new gTLD against the CA’s records of valid certificates and (2) cease
issuing Certificates containing a Domain Name that includes the new gTLD
until after the CA has first verified the Subscriber's control over or
exclusive right to use the Domain Name in accordance with Section
11.1.</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">Within 120 days after the publication of
a contract for a new gTLD is published on [www.icann.org], CAs MUST revoke
each Certificate containing a Domain Name that includes the new gTLD unless
the Subscriber is either the Domain Name Registrant or can demonstrate
control over the Domain Name.</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">... Erratum Ends ...</font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">The review period for this ballot shall
commence at 21:00 UTC on 6 February 2013 and will close at 21:00 UTC on
13 February 2013. Unless the motion is withdrawn during the review period,
the voting period will start immediately thereafter and will close at 21:00
UTC on 20 February 2013. Votes must be cast by posting an on-list reply
to this thread. </font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">... Motions ends ... </font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">A vote in favor of the motion must indicate
a clear 'yes' in the response. </font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">A vote against must indicate a clear 'no'
in the response. A vote to abstain must indicate a clear 'abstain' in the
response. Unclear responses will not be counted. The latest vote received
from any representative of a voting member before the close of the voting
period will be counted. </font>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">Voting members are listed here: </font><a href=http://www.cabforum.org/forum.html><font size=3 face="Calibri">http://www.cabforum.org/forum.html
</font></a>
<br><font size=3 face="Calibri"> </font>
<br><font size=3 face="Calibri">In order for the motion to be adopted,
two thirds or more of the votes cast by members in the CA category and
one half or more of the votes cast by members in the browser category must
be in favor. Also, at least seven members must participate in the ballot,
either by voting in favor, voting against or abstaining.</font><tt><font size=2>_______________________________________________<br>
Public mailing list<br>
Public@cabforum.org<br>
</font></tt><a href=https://cabforum.org/mailman/listinfo/public><tt><font size=2>https://cabforum.org/mailman/listinfo/public<br>
</font></tt></a>
<br>