<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle23
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle24
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle25
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>I included some links in the previous email I forwarded. However, the reason boils down to the fact that they use the DC as part of the Subject’s distinguished name to indicate the community of interest to which the certificate applies. I’ll see if I can dig up (and circulate) documentation from the IGTF community on what they do with this information and why exactly the RA/Issuer’s domain is specified. <o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>Steve Roylance<br><b>Sent:</b> Wednesday, May 22, 2013 10:50 AM<br><b>To:</b> Jeremy Rowley<br><b>Cc:</b> public@cabforum.org<br><b>Subject:</b> Re: [cabfpub] BR Section 9.2.3 incompatability<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>Hi Jeremy<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>Thanks for the examples which makes things much clearer (in terms of the application) but not necessarily clear for relying parties understanding of the Subject DN of a certificate. Is there a particular link to some background on why the IGTF chose to use the Subject DN to convey the association links? I'm not familiar with the background to this. <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>I see no issue with Name Constraints related testing we have done for DC=<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>Thanks<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>Steve<o:p></o:p></span></p></div><div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div></div></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='color:black'>From: </span></b><span style='color:black'>Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com">jeremy.rowley@digicert.com</a>><br><b>Organization: </b>DigiCert<br><b>Reply-To: </b>Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com">jeremy.rowley@digicert.com</a>><br><b>Date: </b>Wednesday, 15 May 2013 20:47<br><b>To: </b>Steve Roylance <<a href="mailto:steve.roylance@globalsign.com">steve.roylance@globalsign.com</a>><br><b>Cc: </b><<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br><b>Subject: </b>RE: [cabfpub] BR Section 9.2.3 incompatability<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'><o:p> </o:p></span></p></div><div><div><p class=MsoNormal><span style='color:#1F497D'>Attached are three examples from various CAs. Notice that each has a DC of the RA or CA, not the subject. This is per the grid requirements.</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> </span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Jeremy</span><span style='color:black'><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> </span><span style='color:black'><o:p></o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:black'> <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Steve Roylance<br><b>Sent:</b> Saturday, May 11, 2013 5:00 AM<br><b>To:</b> Jeremy Rowley<br><b>Cc:</b> <a href="mailto:public@cabforum.org">public@cabforum.org</a><br><b>Subject:</b> Re: [cabfpub] BR Section 9.2.3 incompatability</span><span style='color:black'><o:p></o:p></span></p></div></div><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><div><div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>Hi Jeremy,</span><span style='color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'> </span><span style='color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>In some instances, outside of SSL usage, it's necessary to use DC within Name Constraints where AD is used as the engine to populate the Subject DN through auto enrolment. DC therefore offers a stable base to be able to use Name Constraints. Do you possibly have a couple of example certificate Subject DN's that you could highlight good/bad examples? I think that would help everyones understanding of the proposal and how it addresses the issue you'd like to solve.</span><span style='color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'> </span><span style='color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>Thanks.</span><span style='color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'> </span><span style='color:black'><o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>Steve</span><span style='color:black'><o:p></o:p></span></p></div><div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'> </span><span style='color:black'><o:p></o:p></span></p></div></div></div></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'> </span><span style='color:black'><o:p></o:p></span></p></div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='color:black'>From: </span></b><span style='color:black'>Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com">jeremy.rowley@digicert.com</a>><br><b>Organization: </b>DigiCert<br><b>Reply-To: </b>Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com">jeremy.rowley@digicert.com</a>><br><b>Date: </b>Friday, 10 May 2013 19:01<br><b>To: </b><<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br><b>Subject: </b>[cabfpub] BR Section 9.2.3 incompatability<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'> </span><span style='color:black'><o:p></o:p></span></p></div><div><div><p class=MsoNormal><span style='color:black'>It’s come to my attention that section 9.2.3 has a potential incompatibility with the requirements imposed by IGTF and other similar communities. <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Section 9.2.3:<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>9.2.3 Subject Domain Component Field <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Certificate Field: subject:domainComponent (OID 0.9.2342.19200300.100.1.25)<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Required/Optional: Optional. <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Contents: If present, this field MUST contain all components of the subject’s Registered Domain Name in ordered sequence, with the most significant component, closest to the root of the namespace, written last.<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>From OGF GFD.125 [<a href="http://www.ogf.org/documents/GFD.125.pdf">http://www.ogf.org/documents/GFD.125.pdf</a>] Section 2.3.2:<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'> <o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'>To ensure uniqueness and proper delegation, the use of domainComponent (DC) naming corresponding to a registered DNS name owned by the authority at the beginning of the issuer and subject name RDN sequence is strongly encouraged. In that case, the ASN.1 SEQUENCE MUST start with the domainComponent representing the top-level domain, for example “DC=org” or “DC=eu”.<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'> <o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'>The need for this comes from the fact that identification is based on the subject DN only. From the IGTF Federation Document:<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'> <o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'>"3.1 Management and communication of identifiers<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'> <o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'>On accreditation, a specific subject name space or set of subject name spaces is allocated to each authority. This name space must not overlap with any existing name space already assigned to an existing authority for any AP, assigned by any of the regional PMAs within the International Grid Trust Federation."<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'> <o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'>Really, it boils down to the fact that the IGTF space and others expect to use the DC field to indicate a responsible community or verifier. Therefore, I propose we modify Section 9.2.3. to permit issue, community, and RA information in the DC as well as subject information. <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>My proposal:<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>9.2.3 Subject Domain Component Field <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Certificate Field: subject:domainComponent (OID 0.9.2342.19200300.100.1.25)<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Required/Optional: Optional. <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'>Contents: If present, this field MUST contain all components of a verified Domain Name (such as the Domain Name of the subject, issuer, or RA) in ordered sequence, with the most significant component, closest to the root of the namespace, written last.<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'> <o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'>Let me know if you are interested in endorsing.<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'> <o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'>Thanks,<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'> <o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'>Jeremy<o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'> <o:p></o:p></span></p><p class=MsoPlainText><span style='color:black'> <o:p></o:p></span></p><p class=MsoNormal><span style='color:black'> <o:p></o:p></span></p></div></div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:black'>_______________________________________________ Public mailing list <a href="mailto:Public@cabforum.org">Public@cabforum.org</a> <a href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a> </span><span style='color:black'><o:p></o:p></span></p></div></div></div></body></html>