<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:.5in;
mso-add-space:auto;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoListParagraphCxSpFirst, li.MsoListParagraphCxSpFirst, div.MsoListParagraphCxSpFirst
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoListParagraphCxSpMiddle, li.MsoListParagraphCxSpMiddle, div.MsoListParagraphCxSpMiddle
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
mso-add-space:auto;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoListParagraphCxSpLast, li.MsoListParagraphCxSpLast, div.MsoListParagraphCxSpLast
{mso-style-priority:34;
mso-style-type:export-only;
margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:.5in;
mso-add-space:auto;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:123618046;
mso-list-type:hybrid;
mso-list-template-ids:2040330528 69140495 69140505 69140507 69140495 69140505 69140507 69140495 69140505 69140507;}
@list l0:level1
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>All,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>During tomorrow’s telephone call I’d like to review the take-aways from our Munich F2F. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Here are some of the items:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Sunsetting of 1024-bit certificates – Who would like to write up and circulate an updated, post-F2F synopsis of what they believe is the status on how CAs, Browsers, and Subscribers are doing in their efforts to sunset 1024-bit certificates?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ben will work on a “SHOULD” recommendation / p<span style='color:black'>roposed ballot that CAs “should” offer SHA2 as the default option for certificate signatures. That way applicants would opt-out of SHA2 and select SHA1 and this would push “natural attenuation” away from SHA1. </span><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Guidelines Hand-off Date <o:p></o:p></p><p class=MsoNormal>If we are to begin implementing a new hand-off-date approach for CABF guideline documents (i.e. Sept. 30 off each year), then are there any tasks that we should try to accomplish in the next 90 days to get the most benefit from a cyclical process? What can we do to improve upon the concept now? For instance, would any of you like to work on an update to Exhibit C of the Bylaws? (Section 5.6 of the Bylaws states, “Project Lifecycle - In general, Forum projects will follow the model Project Lifecycle attached as Exhibit C. However, the Members may modify this model as appropriate by their subsequent actions.”) Also, the minutes indicate that Kirk would circulate his prior proposal re: an annual cycle for changes to CABF standards and WebTrust/ETSI standards with modifications based on the discussion by the group, with input from Jeremy and Don. How might this be harmonized with the foregoing? Finally, there were comments that CAs would appreciate it if browsers could provide clarity and uniformity on effective dates for audit requirements. Can browser members take on a task to develop a coordinated policy/process on this?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Who would like to take on an assignment to draft amendments to the guidelines that will remove specific references within them to WebTrust and ETSI version numbers? (That would mainly be in the audit criteria sections, not in the new explanatory introduction sections). <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Governance- Kirk is working on a proposed definition of Observer Status for the bylaws.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Lightweight IPR Agreement – Ben is working on this.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Website revision assignments<o:p></o:p></p><p class=MsoListParagraphCxSpFirst style='text-indent:-.25in;mso-list:l0 level1 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>1.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Assignments will be made for CABF members for preparing the sections of the web site.<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>a.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Info for Auditors: Don and Inigo<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>b.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Info for Consumers: Simon<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>c.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Info for Web Site Owners and Sys Admins: Robin<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>d.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Info for Manufacturers and Developers: Rick<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>e.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Info for Potential CABF Members: Dean<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>f.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Info for the Press: Gerv<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>g.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Mission, Governance, Procedures, Bylaws and Leadership: Ben<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>h.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Mailing Lists: Ben<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>i.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>IPR: Ben<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>j.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>EV Guidelines: Mads<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>k.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>BR: Mert<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>l.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Working Groups - Code Signing: Dean<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>m.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Browser, root and Other Info: Cornelia<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>n.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Liaisons: Arno<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>o.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Proceedings: John<o:p></o:p></p><p class=MsoListParagraphCxSpMiddle style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>p.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Browser OS Versions: Sig<o:p></o:p></p><p class=MsoListParagraphCxSpLast style='margin-left:1.0in;mso-add-space:auto;text-indent:-.25in;mso-list:l0 level2 lfo1'><![if !supportLists]><span style='mso-list:Ignore'>q.<span style='font:7.0pt "Times New Roman"'> </span></span><![endif]>Research Statistics: Don<o:p></o:p></p><p class=MsoNormal><span style='color:black'>Do we need to form an informal WG / discussion thread to review EV choke points?<o:p></o:p></span></p><p class=MsoNormal><span style='color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:black'>Should we reconvene a subcommittee to work on security enhancements to CA practices? See attachment to email from Jeremy sent prior to the Mozilla F2F with subject line [cabfpub] DRAFT Certificate System Operational Security Requirements and dated 1 Feb. 2013.<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ben needs to circulate a revised Ballot 103 (OCSP Stapling) for discussion.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Revocation checking needs to work across the board. Browsers should be blocking negotiation of certs without an OCSP URL, and auditors should review whether CAs are complying with this Baseline Requirement (that all SSL certificates contain an OCSP URL). <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Where do we take the discussion about browser test suites from the F2F? Where do we go from here? (get <a href="https://www.cabforum.org/wiki/11-12%20June%202013?action=AttachFile&do=get&target=Revocation_Discussion_notes_6-12-13.doc">https://www.cabforum.org/wiki/11-12%20June%202013?action=AttachFile&do=get&target=Revocation_Discussion_notes_6-12-13.doc</a> or view <a href="https://www.cabforum.org/wiki/11-12%20June%202013?action=AttachFile&do=view&target=Revocation_Discussion_notes_6-12-13.doc">https://www.cabforum.org/wiki/11-12%20June%202013?action=AttachFile&do=view&target=Revocation_Discussion_notes_6-12-13.doc</a>)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>We covered a lot of territory during the above-referenced Revocation Discussion. Members should review those notes carefully for more action items.<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Update on technical constraints ballot from Steve Roylance.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ben has incorporated Steve Roylance’s correction into the minutes, but there are certainly other changes / corrections that need to be made to the minutes. How do we want to tackle this (sign-off on the Munich F2F minutes)? <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Rick suggested that browsers take the first steps in experimenting with CAA records. So far, Google has taken a step, and there have been discussions online, but have the other browsers discussed implementing this yet internally, and if so, do they have anything to report? <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Any suggestions on how we prioritize the foregoing items so that we can cover some or all of this during tomorrow’s call?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Cheers,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Ben<o:p></o:p></p></div></body></html>