<html><body><span style="font-family:Verdana; color:#000000; font-size:10pt;"><div>Version 1.1.3 has been posted on the website.</div><div><br></div><div>Thanks,</div><div><br></div><div>Wayne</div><div><br><br></div>
<blockquote id="replyBlockquote" webmail="1" style="border-left: 2px solid blue; margin-left: 8px; padding-left: 8px; font-size:10pt; color:black; font-family:verdana;">
<div id="wmQuoteWrapper">
-------- Original Message --------<br>
Subject: Re: [cabfpub] Next Published Version of Baseline Requirements<br>
From: "Ben Wilson" <<a href="mailto:ben@digicert.com">ben@digicert.com</a>><br>
Date: Mon, March 18, 2013 2:38 pm<br>
To: <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br>
<br>
<style>
#wmQuoteWrapper /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;}
#wmQuoteWrapper @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;}
#wmQuoteWrapper @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;}
#wmQuoteWrapper /* Style Definitions */ p.MsoNormal, #wmQuoteWrapper li.MsoNormal, #wmQuoteWrapper div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:11.0pt; font-family:"Calibri","sans-serif";}
#wmQuoteWrapper a:link, #wmQuoteWrapper span.MsoHyperlink {mso-style-priority:99; color:blue; text-decoration:underline;}
#wmQuoteWrapper a:visited, #wmQuoteWrapper span.MsoHyperlinkFollowed {mso-style-priority:99; color:purple; text-decoration:underline;}
#wmQuoteWrapper span.EmailStyle17 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:windowtext;}
#wmQuoteWrapper span.EmailStyle18 {mso-style-type:personal; font-family:"Calibri","sans-serif"; color:#1F497D;}
#wmQuoteWrapper span.EmailStyle19 {mso-style-type:personal-reply; font-family:"Calibri","sans-serif"; color:#1F497D;}
#wmQuoteWrapper .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;}
#wmQuoteWrapper @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;}
#wmQuoteWrapper div.WordSection1 {page:WordSection1;}
</style><div class="WordSection1"><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D">All,<o:p></o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D">Here is the pre-publication draft of version 1.1.3 of the Baseline Requirements as outlined in my previous emails. Let’s discuss on Thursday’s call.<o:p></o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D">Ben<o:p></o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D"><o:p> </o:p></span></div><div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"><div class="MsoNormal" style="font-size:12pt;"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Ben Wilson [<a href="mailto:ben@digicert.com">mailto:ben@digicert.com</a>] <br><b>Sent:</b> Monday, March 18, 2013 12:38 PM<br><b>To:</b> '<a href="mailto:public@cabforum.org">public@cabforum.org</a>'<br><b>Subject:</b> RE: [cabfpub] Next Published Version of Baseline Requirements<o:p></o:p></span></div></div></div><div class="MsoNormal" style="font-size:12pt;"><o:p> </o:p></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D">All,<o:p></o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D"><o:p> </o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D">The WebTrust Task Force has helpful language in version 1.1, Audit Criteria for Baseline Requirements, which I would like to re-purpose in one of the title pages for version 1.1.3 of the BRs. <o:p></o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D"><o:p> </o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D">What if we said?<o:p></o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D"><o:p> </o:p></span></div><div class="MsoNormal" style="font-size:12pt;margin-left:.5in"><span style="color:#1F497D">Implementers’ Note: Version 1.1 of the SSL Baseline Requirements was published on September 14, 2012. Version 1.1 of WebTrust’s SSL Baseline Audit Criteria and ETSI Technical Standard Electronic Signatures and Infrastructures (ESI) 102 042 version 2.3.1 incorporate version 1.1 of these Baseline Requirements and are currently in effect. See <a target="_blank" href="http://www.webtrust.org/homepage-documents/item27839.aspx">http://www.webtrust.org/homepage-documents/item27839.aspx</a> and <a target="_blank" href="http://www.etsi.org/deliver/etsi_ts/102000_102099/102042/02.03.01_60/ts_102042v020301p.pdf">http://www.etsi.org/deliver/etsi_ts/102000_102099/102042/02.03.01_60/ts_102042v020301p.pdf</a>. The CA / Browser Forum continues to improve the Baseline Requirements, and we encourage all CAs to conform to each revision on the date specified without awaiting a corresponding update to an applicable audit criterion. In the event of a conflict between an existing audit criterion and a guideline revision, we will communicate with the audit community and attempt to resolve any uncertainty, and we will respond to implementation questions directed to <a target="_blank" href="mailto:questions@cabforum.org">questions@cabforum.org</a>. Our coordination with compliance auditors will continue as we develop guideline revision cycles that harmonize with the revision cycles for audit criteria, the compliance auditing periods and cycles of CAs, and the CA / B Forum’s guideline implementation dates. <o:p></o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D"><o:p> </o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D">(Also, instead of creating a redline from version 1.0, it should be based on BR 1.1 because I think that is what was used for ETSI TS 102 042 V2.3.1 (and certainly for v.1.1 of WebTrust for the BRs) and from my review, the changes do not make comparison for compliance purposes that difficult.)<o:p></o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D"><o:p> </o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D">Ben <o:p></o:p></span></div><div class="MsoNormal" style="font-size:12pt;"><span style="color:#1F497D"><o:p> </o:p></span></div><div><div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in"><div class="MsoNormal" style="font-size:12pt;"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a target="_blank" href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a target="_blank" href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Ben Wilson<br><b>Sent:</b> Friday, March 15, 2013 6:14 PM<br><b>To:</b> <a target="_blank" href="mailto:public@cabforum.org">public@cabforum.org</a><br><b>Subject:</b> [cabfpub] Next Published Version of Baseline Requirements<o:p></o:p></span></div></div></div><div class="MsoNormal" style="font-size:12pt;"><o:p> </o:p></div><div class="MsoNormal" style="font-size:12pt;">All,<o:p></o:p></div><div class="MsoNormal" style="font-size:12pt;"><o:p> </o:p></div><div class="MsoNormal" style="font-size:12pt;">In response to Gerv’s email of 28-Jan-2013 (“[cabfpub] CAB Forum Document Versioning”), and changes related to Ballots 71, 93, 96, and 97, I am preparing a proposed version 1.1.3 of the Baseline Requirements – see attached “Document History” table. Also, to address other comments on that same “Versioning” thread, and also to address BR Issue 33 – Title Pages – “No single place to view effective dates”, I’ve created a table of compliance dates. Please review both tables on the attached page. <o:p></o:p></div><div class="MsoNormal" style="font-size:12pt;"><o:p> </o:p></div><div class="MsoNormal" style="font-size:12pt;">To further address comments about ongoing improvements to the Baseline Requirements, I have two more suggestions: (1) we have room for text on this page that could explain a little about how to comply with post-v.1.0 versions of the BRs, assuming CAs are audited under WebTrust for CAs– SSL Baseline Requirements Audit Criteria, V1.0, or ETSI TS 102 042 V2.3.1; and (2) it will be relatively easy to create a redlined PDF that compares BR v. 1.1.3 to BR v. 1.0, so that anyone looking at a WebTrust or ETSI audit can determine whether any post-BR v1.0 changes are relevant to their consideration.<o:p></o:p></div><div class="MsoNormal" style="font-size:12pt;"><o:p> </o:p></div><div class="MsoNormal" style="font-size:12pt;">Ben<o:p></o:p></div></div><hr>_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a><br>
</div>
</blockquote></span></body></html>