<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 12px; font-family: Arial, sans-serif; "><div><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Dear all.</p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">PDF and Word versions attached based on an update to 1.1.3 (As an example). </p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Please note I'm out for the next week but will try to answer where possible any questions. Responses may therefore be delayed</p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Steve</p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Ballot 105 – Technical Constraints for Subordinate Certificate Authorities yielding broader and safer PKI adoption.</strong></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><span class="anchor" id="line-3"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Steve Roylance made the following motion, and Gervase Markham from Mozilla and Stephen Davidson from Quovadis endorsed it:<span class="anchor" id="line-4"></span><span class="anchor" id="line-5"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Motion Begins</strong><span class="anchor" id="line-6"></span><span class="anchor" id="line-7"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">EFFECTIVE IMMEDIATELY, this ballot provides clarity to the language covering external audits for Subordinate CAs, removing ambiguity as well as providing better alignment of the Baseline Requirements to the Mozilla CA Root program where the subject is already covered and accepted by the wider PKI community. In addition, the proposal sets out to aid wider and broader PKI adoption by Subordinate CAs by defining the use of Technical Constraints and highlighting how additional barriers to adoption within the guidelines can be optional when using Name Constraints, specifically the requirement for ‘OCSP Good’ responses originally proposed in Ballot 100. We propose amending the Baseline Requirements Guidelines as follows:<span class="anchor" id="line-8"></span><span class="anchor" id="line-9"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Section 1 – Scope</strong> <em><strong>(Adding scope)</strong></em><span class="anchor" id="line-10"></span><span class="anchor" id="line-11"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">These Requirements are applicable to all Certification Authorities within a chain of trust starting at the Root CA and flowing down through successive Subordinate CAs.<span class="anchor" id="line-12"></span><span class="anchor" id="line-13"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Section 4 – Definitions</strong> <em><strong>(Additional Definition)</strong></em><span class="anchor" id="line-14"></span><span class="anchor" id="line-15"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Technically Constrained Subordinate CA: A Subordinate CA that uses a combination of Extended Key Usage settings and Name Constraint settings to limit the scope within which a Subordinate CA may issue Certificates.<span class="anchor" id="line-16"></span><span class="anchor" id="line-17"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Section 9.2 Subject Information</strong> <em><strong>(Amending the section title)</strong></em><span class="anchor" id="line-18"></span><span class="anchor" id="line-19"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>9.2 Subject Information – End Entity Certificates</strong><span class="anchor" id="line-20"></span><span class="anchor" id="line-21"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Section 9.2.7 Other Subject Attributes</strong> <em><strong>(Moving to 9.2.8)</strong></em><span class="anchor" id="line-22"></span><span class="anchor" id="line-23"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Section 9.2.7 Subject Information – Subordinate CA Certificates</strong> <em><strong>(Adding a new section)</strong></em><span class="anchor" id="line-24"></span><span class="anchor" id="line-25"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">By issuing a Subordinate CA Certificate, the CA represents that it followed the procedure set forth in its Certificate Policy and/or Certification Practice Statement to verify that, as of the Certificate’s issuance date, all of the Subject Information was accurate.<span class="anchor" id="line-26"></span><span class="anchor" id="line-27"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Section 9.4 Validity Period</strong> <em><strong>(Clarifying the Validity Period for Subscriber Certificates)</strong></em><span class="anchor" id="line-28"></span><span class="anchor" id="line-29"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Was:-<span class="anchor" id="line-30"></span><span class="anchor" id="line-31"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>9.4 Validity Period</strong> <span class="anchor" id="line-32"></span>Certificates issued after the Effective Date MUST have a Validity Period no greater than 60 months. <span class="anchor" id="line-33"></span>Except as provided for below, Certificates issued after 1 April 2015 MUST have a Validity Period no greater than 39 months. <span class="anchor" id="line-34"></span>Beyond 1 April 2015, CAs MAY continue to issue Certificates with a Validity Period greater than 39 months but not greater than 60 months provided that the CA documents that the Certificate is for a system or software that:<span class="anchor" id="line-35"></span><span class="anchor" id="line-36"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Amended to:-<span class="anchor" id="line-37"></span><span class="anchor" id="line-38"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>9.4 Validity Period</strong> <span class="anchor" id="line-39"></span><strong>9.4.1 Subscriber Certificates</strong> <span class="anchor" id="line-40"></span>Subscriber Certificates issued after the Effective Date MUST have a Validity Period no greater than 60 months. <span class="anchor" id="line-41"></span>Except as provided for below, Subscriber Certificates issued after 1 April 2015 MUST have a Validity Period no greater than 39 months. <span class="anchor" id="line-42"></span>Beyond 1 April 2015, CAs MAY continue to issue Subscriber Certificates with a Validity Period greater than 39 months but not greater than 60 months provided that the CA documents that the Certificate is for a system or software that:<span class="anchor" id="line-43"></span><span class="anchor" id="line-44"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>9.5 Subscriber Public Key</strong> <em><strong>(Alignment of Key checking for all certificates)</strong></em><span class="anchor" id="line-45"></span><span class="anchor" id="line-46"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>9.5 Public Key</strong><span class="anchor" id="line-47"></span><span class="anchor" id="line-48"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>9.7 Additional Technical Requirement</strong> <em><strong>(Moving to Section 9.8)</strong></em><span class="anchor" id="line-49"></span><span class="anchor" id="line-50"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>9.7 Technical Constraints in Subordinate CAs via Name Constraints & EKU</strong> <em><strong>(New section)</strong></em><span class="anchor" id="line-51"></span><span class="anchor" id="line-52"></span></p><p class="line867" style="background-color: rgb(255, 255, 255); "><strong style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); ">9.7 Technical Constraints in Subordinate CAs via Name Constraints & EKU</strong><font face="Arial,Lucida Grande,sans-serif"> <span class="anchor" id="line-53"></span>For a Subordinate CA certificate to be considered Technically Constrained, the certificate MUST include an Extended Key Usage (EKU) extension specifying all extended key usages that the Subordinate CA is authorized to issue certificates for. The anyExtendedKeyUsage KeyPurposeId MUST NOT appear within this extension. If the Subordinate CA certificate includes the id-kp-serverAuth extended key usage, then the Subordinate CA MUST include the Name Constraints X.509v3 extension with constraints on dNSName, iPAddress and DirectoryName as follows:-</font></p><blockquote style="margin:0 0 0 40px; border:none; padding:0px;"><p class="line867" style="background-color: rgb(255, 255, 255); "><font face="Arial,Lucida Grande,sans-serif">(a) For each dNSName in permittedSubtrees, the CA MUST confirm that the Applicant has registered the dNSName or has been authorized by the domain registrant to act on the registrant's behalf in line with the verification practices of section 11.1 </font></p><p class="line867" style="background-color: rgb(255, 255, 255); "><font face="Arial,Lucida Grande,sans-serif">(b) For each iPAddress range in permittedSubtrees, the CA MUST confirm that the Applicant has been assigned the iPAddress range or has been authorized by the assigner to act on the assignee's behalf.</font></p><p class="line867" style="background-color: rgb(255, 255, 255); "><font face="Arial,Lucida Grande,sans-serif">(c) For each DirectoryName in permittedSubtrees the CA MUST confirm the Applicants and/or Subsidiary’s Organizational name and location such that end entity certificates issued from the subordinate CA will be in compliancy with section 9.2.4 and 9.2.5.</font></p></blockquote><p class="line867" style="background-color: rgb(255, 255, 255); "><font face="Arial,Lucida Grande,sans-serif">If the Subordinate CA is not allowed to issue certificates with an iPAddress, then the Subordinate CA certificate MUST specify the entire IPv4 and IPv6 address ranges in excludedSubtrees. The Subordinate CA certificate MUST include within excludedSubtrees an iPAddress GeneralName of 8 zero octets (covering the IPv4 address range of 0.0.0.0/0). The Subordinate CA certificate MUST also include within excludedSubtrees an iPAddress GeneralName of 32 zero octets (covering the IPv6 address range of ::0/0). Otherwise, the subordinate CA certificate MUST include at least one iPAddress in permittedSubtrees.</font></p><p class="line867" style="background-color: rgb(255, 255, 255); "><span style="font-family: Arial, 'Lucida Grande', sans-serif; ">A decoded example for issuance to the domain and sub domains of example.com by organization :- Example LLC, Boston, Massachusetts, US would be:-</span></p><p class="line867" style="background-color: rgb(255, 255, 255); "><span style="font-family: Arial, 'Lucida Grande', sans-serif; "><span class="Apple-tab-span" style="white-space:pre"> </span>X509v3 Name Constraints:</span></p><p class="line867" style="background-color: rgb(255, 255, 255); "><font face="Arial,Lucida Grande,sans-serif"><span class="Apple-tab-span" style="white-space:pre"> </span>Permitted:</font></p><p class="line867" style="background-color: rgb(255, 255, 255); "><font face="Arial,Lucida Grande,sans-serif"><span class="Apple-tab-span" style="white-space:pre"> </span>DNS:example.com </font></p><p class="line867" style="background-color: rgb(255, 255, 255); "><font face="Arial,Lucida Grande,sans-serif"><span class="Apple-tab-span" style="white-space:pre"> </span>DirName: C=US, ST=MA, L=Boston, O=Example LLC</font></p><p class="line867"><span class="Apple-tab-span" style="white-space: pre; "> </span>Excluded:</p><div><span class="anchor" id="line-67"></span><div><p class="line891" style="margin: 0.25em 0px; "><span class="Apple-tab-span" style="white-space:pre"> </span>IP:0.0.0.0/0.0.0.0 </p><p class="line891" style="margin: 0.25em 0px; "><span class="anchor" id="line-68"></span><span class="Apple-tab-span" style="white-space:pre"> </span>IP:0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0<span class="anchor" id="line-69"></span><span class="anchor" id="line-70"></span></p></div></div><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; background-color: rgb(255, 255, 255); ">If the Subordinate CA is not allowed to issue certificates with dNSNames, then the subordinate CA certificate MUST include a zero-length dNSName in excludedSubtrees. Otherwise, the subordinate CA certificate MUST include at least one dNSName in permittedSubtrees.<span class="anchor" id="line-71"></span><span class="anchor" id="line-72"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Section 11.1.1 Authorization by Domain Name Registrant</strong> <em><strong>(Adding clarification)</strong></em><span class="anchor" id="line-73"></span><span class="anchor" id="line-74"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Note: FQDNs may be listed in Subscriber Certificates using dNSNames in the subjectAltName extension or in Subordinate CA Certificates via dNSNames in permittedSubtrees within the Name Constraints extension.<span class="anchor" id="line-75"></span><span class="anchor" id="line-76"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Section 11.1.2 Authorization for an IP Address</strong> <em><strong>(Adding clarification)</strong></em><span class="anchor" id="line-77"></span><span class="anchor" id="line-78"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Note: IPAddresses may be listed in Subscriber Certificates using IPAddress in the subjectAltName extension or in Subordinate CA Certificates via IPAddress in permittedSubtrees within the Name Constraints extension.<span class="anchor" id="line-79"></span><span class="anchor" id="line-80"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Section 13.2.6 Response for non-issued certificates</strong> <em><strong>(Amending applicability)</strong></em><span class="anchor" id="line-81"></span><span class="anchor" id="line-82"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Was:-<span class="anchor" id="line-83"></span><span class="anchor" id="line-84"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>13.2.6 Response for non-issued certificates</strong> <span class="anchor" id="line-85"></span>If the OCSP responder receives a request for status of a certificate that has not been issued, then the responder SHOULD NOT respond with a "good" status. The CA SHOULD monitor the responder for such requests as part of its security response procedures. <span class="anchor" id="line-86"></span>Effective 1 August 2013, OCSP responders MUST NOT respond with a "good" status for such certificates.<span class="anchor" id="line-87"></span><span class="anchor" id="line-88"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Amended to:-<span class="anchor" id="line-89"></span><span class="anchor" id="line-90"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>13.2.6 Response for non-issued certificates</strong> <span class="anchor" id="line-91"></span>If the OCSP responder receives a request for status of a certificate that has not been issued, then the responder SHOULD NOT respond with a "good" status. The CA SHOULD monitor the responder for such requests as part of its security response procedures. <span class="anchor" id="line-92"></span>Effective 1 August 2013, OCSP responders for CAs which are not Technically Constrained in line with Section 9.7 MUST NOT respond with a "good" status for such certificates.<span class="anchor" id="line-93"></span><span class="anchor" id="line-94"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Section 17 Audit</strong> <em><strong>(Clarification notes added to the section heading)</strong></em><span class="anchor" id="line-95"></span><span class="anchor" id="line-96"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Certificates that are capable of being used to issue new certificates MUST either be Technically Constrained in line with section 9.7 and audited in line with section 17.9 only, or Unconstrained and fully audited in line with all remaining requirements from section 17. A Certificate is deemed as capable of being used to issue new certificates if it contains an X.509v3 basicConstraints extension, with the cA boolean set to true and is therefore by definition a Root CA or a Subordinate CA.<span class="anchor" id="line-97"></span><span class="anchor" id="line-98"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Section 17.9 Regular Quality Assessment of Technically Constrained Subordinate CAs</strong> <em><strong>(New Section)</strong></em><span class="anchor" id="line-99"></span><span class="anchor" id="line-100"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">During the period in which a Technically Constrained Subordinate CA issues Certificates, the CA which signed the Subordinate CA SHALL monitor adherence to the CA’s Certificate Policy and the Subordinate CA’s Certification Practice Statement. On at least a quarterly basis, against a randomly selected sample of the greater of one certificate or at least three percent of the Certificates issued by the Subordinate CA, during the period commencing immediately after the previous audit sample was taken, the CA shall ensure all applicable Baseline Requirements are met.<span class="anchor" id="line-101"></span><span class="anchor" id="line-102"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Appendix B - Certificate Extensions (Normative)</strong> <em><strong>(Clarify F and add G)</strong></em><span class="anchor" id="line-103"></span><span class="anchor" id="line-104"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Was:-<span class="anchor" id="line-105"></span><span class="anchor" id="line-106"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>F. nameConstraints (optional)</strong> <span class="anchor" id="line-107"></span>If present, this extension SHOULD be marked critical*. <span class="anchor" id="line-108"></span>* Non-critical Name Constraints are an exception to RFC 5280 that MAY be used until the Name Constraints extension is supported by Application Software Suppliers whose software is used by a substantial portion of Relying Parties worldwide.<span class="anchor" id="line-109"></span><span class="anchor" id="line-110"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">Amended to:-<span class="anchor" id="line-111"></span><span class="anchor" id="line-112"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>F. nameConstraints (optional)</strong> <span class="anchor" id="line-113"></span>If present, this extension SHOULD be marked critical*. <span class="anchor" id="line-114"></span>* Non-critical Name Constraints are an exception to RFC 5280 (4.2.1.10), however, they MAY be used until the Name Constraints extension is supported by Application Software Suppliers whose software is used by a substantial portion of Relying Parties worldwide. <span class="anchor" id="line-115"></span><strong>G. extkeyUsage (optional)</strong> <span class="anchor" id="line-116"></span>For Subordinate CA Certificates to be Technically constrained in line with section 9.8, then either the value id-kp-serverAuth [RFC5280] or id-kp-clientAuth [RFC5280] or both values MUST be present**. <span class="anchor" id="line-117"></span>Other values MAY be present. <span class="anchor" id="line-118"></span>** Generally Extended Key Usage will only appear within end entity certificates (as highlighted in RFC 5280 (4.2.1.12)), however, Subordinate CAs MAY include the extension to further protect relying parties until the use of the extension is consistent between Application Software Suppliers whose software is used by a substantial portion of Relying Parties worldwide.<span class="anchor" id="line-119"></span><span class="anchor" id="line-120"></span></p><p class="line874" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">The review period for this ballot shall commence on July 15th, 2013 and will close on July 22nd, 2013. Unless the motion is withdrawn during the review period, the voting period will start immediately thereafter and will close at July 29, 2013. Votes must be cast by posting an on-list reply to this thread.<span class="anchor" id="line-121"></span><span class="anchor" id="line-122"></span></p><p class="line867" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); "><strong>Motion Ends</strong><span class="anchor" id="line-123"></span><span class="anchor" id="line-124"></span></p><p class="line862" style="font-family: Arial, 'Lucida Grande', sans-serif; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); ">A vote in favor of the motion must indicate a clear 'yes' in the response. A vote against must indicate a clear 'no' in the response. A vote to abstain must indicate a clear 'abstain' in the response. Unclear responses will not be counted. The latest vote received from any representative of a voting member before the close of the voting period will be counted. Voting members are listed here: <a class="http" href="http://www.cabforum.org/forum.html" style="color: blue; border: 0px; text-decoration: none; ">http://www.cabforum.org/forum.html</a> <span class="anchor" id="line-125"></span>In order for the motion to be adopted, two thirds or more of the votes cast by members in the CA category and one half or more of the votes cast by members in the browser category must be in favor. Also, at least seven members must participate in the ballot, either by voting in favor, voting against, or abstaining.</p></div><div style="font-family: Arial, sans-serif; color: rgb(0, 0, 0); font-size: 12px; "><p></p></div></body></html>