<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.emailquote, li.emailquote, div.emailquote
{mso-style-name:emailquote;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:1.0pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>OK, I’ll resend it next week. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> Ben Wilson [mailto:ben@digicert.com] <br><b>Sent:</b> Friday, August 16, 2013 10:26 AM<br><b>To:</b> Rick Andrews; public@cabforum.org<br><b>Subject:</b> RE: [cabfpub] Ballot 89 Rewrite<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Rick,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Before this ballot goes to review and vote, I think we will get more browsers to vote in favor of it if we make some of the changes outlined in the following comments table (which references the version I sent out the other day).<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Thanks,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Ben<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 width=637 style='width:477.75pt;border-collapse:collapse'><thead><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Pg.<o:p></o:p></span></b></p></td><td width=50 valign=top style='width:37.5pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Line<o:p></o:p></span></b></p></td><td width=42 valign=top style='width:31.5pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Sec.<o:p></o:p></span></b></p></td><td width=264 valign=top style='width:2.75in;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Comment<o:p></o:p></span></b></p></td><td width=246 valign=top style='width:184.5pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Suggestion to Remedy<o:p></o:p></span></b></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>3<o:p></o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>2<o:p></o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>1<o:p></o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>I am wondering whether Browser members of the CABF will be more inclined to vote in favor of posting this document if we removed the word “established”? The word “established” seems to be too strong for browsers to accept.<o:p></o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Rephrase this to read, “This document contains recommendations by members of the CA/Browser Forum …”<o:p></o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>3<o:p></o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>14-15<o:p></o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>2<o:p></o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>I am also wondering whether the Browsers would prefer that we replace “rely on” with the phrase “create software products that process”? (“Rely” might carry legal/PKI interpretations.)<o:p></o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Rephrase the sentence to read, “This document contains recommendations for Application Software Suppliers who create software products that process Extended Validation certificates.”<o:p></o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>4<o:p></o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>17-18<o:p></o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>6.1<o:p></o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Browser members might want to remove the word “shall” here. What if we replaced the phrase “An Application Software Supplier shall recognize a CSP that is qualified to issue EV SSL” with the phrase “An Application Software Supplier shall determine whether a CSP is qualified to issue EV SSL”? The “shall recognize” seems to be too much of a mandate, even though the rest of the document implies that these are recommendations.<o:p></o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Rephrase the sentence to read, “An Application Software Supplier shall determine whether a CSP is qualified to issue EV SSL certificates by means of the CSP's audit report.” <o:p></o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>4<o:p></o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>20<o:p></o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>6.1<o:p></o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>The phrase “an acceptable audit program” is too vague. We have audit requirements in the EV Guidelines which should be referenced. <o:p></o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Rephrase the sentence to read, “The Application Software Supplier should check that the report was issued by an auditor certified to conduct audits in accordance with an audit program specified in [EVSSL].”<o:p></o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>5<o:p></o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>10-11<o:p></o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>7.1<o:p></o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>The sentence “The notice should include the terms upon which such CSPs will be included, as described in Sections 7.2 through 7.6 below.” seems to be too prescriptive. I am wondering whether it would be better if we made it clear that the list in section 7 is a guide and not a requirement?<o:p></o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Rephrase the sentence to read, “The notice should include the terms upon which such CSPs will be included, <u>such</u> as<u> those</u> described in Sections 7.2 through 7.6 below, <u>as appropriate</u>.” <o:p></o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>5<o:p></o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>11-12<o:p></o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>7.1<o:p></o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>At first I was confused by the sentence, “It need not be performed for each new CSP or root certificate that the Application Software Supplier intends to add.” I think it would benefit from a clearer statement about what it intends to say—i.e. we do not want email every time a browser adds a new root or CA. <o:p></o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Rephrase the sentence to read, “This requested notice to the CA/Browser Forum is not necessary for subsequent CSPs or root certificates that the Application Software Supplier intends to add.”<o:p></o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>5<o:p></o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>20, 28, 39<o:p></o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>7.3, 7.4, 7.5<o:p></o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>I do not feel too strongly about this, but since we’re talking about <u>both</u> the <u>notice</u> to the CABF and the <u>agreement</u> in section 7, we should change the first sentence of these sections -- “The <u>notice and/or the</u> agreement...” <o:p></o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Add “notice and/or the” to the first sentence of sections 7.3, 7.4, and 7.5.<o:p></o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>7<o:p></o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>16<o:p></o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>13<o:p></o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Browsers have been opposed to exhausting all available validation sources. So the phrase “try all available alternative services” should be edited. One possible solution is to say, “it should try an alternative service for certificate status information, if available.” <o:p></o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Revise sentence to read, “If the application cannot obtain a response using one service, then it should try an alternative service for certificate status information, if available.”<o:p></o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'><o:p> </o:p></span></p></td></tr><tr><td width=35 valign=top style='width:26.4pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>8<o:p></o:p></span></p></td><td width=50 valign=top style='width:37.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>17-18<o:p></o:p></span></p></td><td width=42 valign=top style='width:31.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>16<o:p></o:p></span></p></td><td width=264 valign=top style='width:2.75in;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>Finally, I think we need to replace the final sentence of the document. It currently reads, “This document lays<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>out appropriate requirements on the relying application.” To the left is one suggestion.<o:p></o:p></span></p></td><td width=246 valign=top style='width:184.5pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt'><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial","sans-serif"'>“Because EV Certificates play an important role in securing the online ecosystem, we provide these recommendations to application developers to help them protect users when visiting EV-protected websites.”<o:p></o:p></span></p></td></tr></thead></table><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>Rick Andrews<br><b>Sent:</b> Tuesday, August 13, 2013 4:23 PM<br><b>To:</b> public@cabforum.org<br><b>Subject:</b> [cabfpub] Ballot 89 Rewrite<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>I am withdrawing the current Ballot 89 language and replacing it as outlined below. A while back, I volunteered to update the Guidance to Application Developers (version 1, dated 2009, at <a href="https://www.cabforum.org/Guidelines_for_the_processing_of_EV_certificates%20v1_0.pdf">https://www.cabforum.org/Guidelines_for_the_processing_of_EV_certificates%20v1_0.pdf</a>). Based on comments received, edits were made to both the guideline document and the ballot. However, more recently I began to understand that none of the browser vendors were supportive of my changes. Of particular note, I received objections to some provisions in version 2, but then I saw that the same language currently exists in the 2009 version on the CABF website (i.e., that a browser should drop EV treatment for certificates that don’t meet crypto requirements (Section 10) and that browsers should adjust their Root Embedding Programs accordingly (Section 7)). So my conclusion is that browser vendors might not be supportive of version 1 either. However, as a final effort, I have edited the document again and renamed it to: “Recommendations for the Processing of EV SSL Certificates.” You can view changes from version 1 in the attached documents.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>Therefore, I am proposing that Ballot 89 go forward as follows, if I can get two endorsers:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>Ballot 93 - Reasons for Revocation (BR issues 6, 8, 10, 21)<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>Rick Andrews (Symantec) made the following motion, endorsed by ? and ?:<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>--- Motion begins ---<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>A “YES” vote on Ballot 89 means that the member votes to remove the 2009 Version 1.0 of “GUIDELINES for the PROCESSING of EXTENDED VALIDATION CERTIFICATES” from the public CA Browser Forum website and replace it with the attached “RECOMMENDATIONS for the PROCESSING of EXTENDED VALIDATION CERTIFICATES”.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>A “NO” vote on the ballot means that the member votes to remove the 2009 Version 1.0 of “GUIDELINES for the PROCESSING of EXTENDED VALIDATION CERTIFICATES” on the public CA Browser Forum website and not replace it.<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>... Motion ends ...<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'>-Rick<o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div><div><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Calibri","sans-serif"'> <o:p></o:p></span></p></div></div></div></body></html>