<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>This is a Draft Ballot to address BR Issue 7. I’ve reworked it since our last discussion, and I’m looking for endorsers. One question that we need to resolve is whether (5) below is premature. It states, “The certificate MAY contain the TLS Feature Extension advertising that the status_request feature of OCSP stapling is available and supported by the subscriber.” (Must staple) If premature, then subsection (5) of the motion can be deleted. However, if we think we can address this now, then we can leave it in. Eventually whether we use IETF OIDs or our own CABF OIDs, (we’ve said that must-staple was going to have the OID of 2.23.140.16.1), any numbers could be added in later as parentheticals. A redlined PDF of the proposal is attached.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ballot 103 OCSP Stapling and AIA Errata<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ben Wilson of DigiCert made the following motion, and ____ from _____ and ______ from ______ endorsed it:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>---Motion Begins ---<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>EFFECTIVE IMMEDIATELY, in order to correct erroneous statements concerning the allowance of stapling in section 13.2.1 and the requirement for an authorityInformationaccess (AIA) uniform resource identifier for OCSP responders in Appendix B of the Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates, we propose the following amendments:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>---List of errata begins---<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>(1) In Section 13.2.1 “Mechanisms” DELETE the first clause in the second paragraph "If the Subscriber Certificate is for a high-traffic FQDN,so that as amended the section reads as follows:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>"13.2.1 Mechanisms<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The CA SHALL make revocation information for Subordinate Certificates and Subscriber Certificates available in accordance with Appendix B.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The CA MAY rely on stapling, in accordance with [RFC4366], to distribute its OCSP responses. In this case, the CA SHALL ensure that the Subscriber “staples” the OCSP response for the Certificate in its TLS handshake. The CA SHALL enforce this requirement on the Subscriber either contractually, through the Subscriber or Terms of Use Agreement, or by technical review measures implement by the CA."<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>(2) In Appendix B "2. Subordinate CA Certificate" remove point C (authorityInformationAccess) and insert:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>C. authorityInformationAccess <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This extension MUST be present. It MUST NOT be marked critical, and it MUST contain the HTTP URL of the Issuing CA’s OCSP responder (accessMethod = 1.3.6.1.5.5.7.48.1). <o:p></o:p></p><p class=MsoNormal>See Section 13.2.1 for details about OCSP stapling requirements.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Certificates that are not issued by a Root CA SHOULD contain an AIA with the HTTP URL where a copy of the Issuing CA’s certificate (accessMethod = 1.3.6.1.5.5.7.48.2) can be downloaded from a 24x7 online repository.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>(3) In Appendix B "3. Subscriber Certificate" remove point C (authorityInformationAccess) and insert:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal> C. authorityInformationAccess <o:p></o:p></p><p class=MsoNormal>This extension MUST be present. It MUST NOT be marked critical, and it MUST contain the HTTP URL of the Issuing CA’s OCSP responder (accessMethod = 1.3.6.1.5.5.7.48.1). <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Subscriber Certificates SHOULD contain an AIA with the HTTP URL where a copy of the Issuing CA’s certificate (accessMethod = 1.3.6.1.5.5.7.48.2) can be downloaded from a 24x7 online repository.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>(4) In Appendix B "3. Subscriber Certificate" remove point D (basicConstraints) and insert:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>D. basicConstraints (optional)<o:p></o:p></p><p class=MsoNormal>If present, this field MUST be marked critical and the cA field MUST be set to false.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>(5) In Appendix B "3. Subscriber Certificate" after point F insert a new point G (TLS Feature Extension) as follows:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>G. TLS Feature Extension (optional)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Subscriber Certificates MAY contain the TLS Feature Extension advertising that the status_request feature of OCSP stapling is available and supported by the subscriber. If present, this field MUST NOT be marked critical. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>=====Motion Ends=====<o:p></o:p></p></div></body></html>