<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On 23 Jul 2013, at 11:50 am, Eddy Nigg (StartCom Ltd.) <<a href="mailto:eddy_nigg@startcom.org">eddy_nigg@startcom.org</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div bgcolor="#FFFFFF" text="#000000" style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">On 07/23/2013 09:40 PM, From Steve Roylance:<br><blockquote cite="mid:B3DDAEA9-6B54-4EFD-A81D-F6A569393DDC@globalsign.com" type="cite"><div>Hi Eddy. </div><div>Ryan is correct as the ballot carves out Name Constrained CAs and is under vote already. The 106 ballot allows grace to the non name constrained entities.</div></blockquote><br>Since it's your ballot I'm coming back to you...the proposed change states:<br><br><blockquote><span style="font-family: Calibri, sans-serif;">Effective 1 August 2013, OCSP responders<span class="Apple-converted-space"> </span></span><u><span style="font-family: Calibri, sans-serif; color: red;">for</span></u><span style="font-family: Calibri, sans-serif; color: red;"> </span><s><span style="font-family: Calibri, sans-serif;">MUST NOT</span></s><span style="font-family: Calibri, sans-serif;"> </span><u><span style="font-family: Calibri, sans-serif; color: red;">CAs which are not Technically Constrained in line with Section 9.7 MUST NOT</span></u><span style="font-family: Calibri, sans-serif; color: red;"> </span><span style="font-family: Calibri, sans-serif;">respond with a "good" status for such certificates.</span><br></blockquote><br>Can you explain the rational if the ballot 106 will be accepted that this is still necessary and warranted? Wouldn't ballot 106 actually make this redundant? If not, why?<br></div></blockquote></div><br><div>As I read it, ballot 106 only changes the date to 2014, while this makes the exception permanent for Technically Constrained CAs.</div><div><br></div><div>At this time I'm inclined to oppose ballot 106, for two reasons:</div><div><br></div><div>1. I think an extra year is too long. I would suggest more like 3 months.</div><div>2. I'm not convinced that there are any CAs for which more time will help; the CAs who aren't complying now don't appear to have definite plans which will achieve compliance nor definite dates by which they can comply.</div><div><br></div><div>On the overall topic, I would make this statement: Our software can do only one of two things in response to an OCSP query: it can treat the certificate as valid, or as invalid. A 'good' response can only be interpreted one way: as an affirmative statement from the CA that our software should treat the certificate as valid.</div></body></html>