<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 10/31/13 1:59 PM, Eddy Nigg
(StartCom Ltd.) wrote:<br>
</div>
<blockquote cite="mid:5272C4BE.9020902@startcom.org" type="cite">
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<br>
On 10/31/2013 09:35 PM, From Kathleen Wilson:
<blockquote cite="mid:5272B119.6040307@mozilla.com" type="cite">
<pre wrap="">These are the issues in play:
* BR 9.1.3 says that the Issuer Organization Name (O) field must not
contain a generic designation. The BIT legacy roots have the DN
"o=admin,c=CH". However, Swiss law apparently reserves this particular
string as a 'brand' to BIT. And, of course, this root was created long
before the BRs were thought of.
</pre>
</blockquote>
<br>
Kathleen, if you recall at the time of the (initial) root
inclusion request regarding this root at Mozilla we had exactly
the very same issue and with an eye on exactly those types of
names the BR does NOT allow such names. This was also discussed at
that time and I would object (on our part should this come up for
vote) to an exception for these kinds of names. Exactly for this
the BR was created to get rid of such practices.<br>
<br>
</blockquote>
<br>
My personal opinion is that we should not over-ride that decision.<br>
<br>
BIT is working towards a new CA Hierarchy, with the new root having
the following Issuer field:<br>
CN = Swiss Government Root CA II<br>
OU = Certification Authorities<br>
OU = Services<br>
O = The Federal Authorities of the Swiss Confederation<br>
C = CH<br>
<br>
I am definitely in favor of this new Issuer field.<br>
<br>
I am asking the CAB Forum to consider the options for the interim,
so the Swiss government websites will continue to work while BIT is
migrating to their new CA hierarchy. As proposed, one option is to
allow the name constraints in this case to contain a DirectoryName
constraint for "o=admin,c=CH". <br>
<br>
To see that Swiss legislation reserves this particular string as a
'brand' for BIT, go to<br>
<a class="moz-txt-link-freetext" href="http://www.eofcom.admin.ch/eofcom/public/searchEofcom_rdn.do">http://www.eofcom.admin.ch/eofcom/public/searchEofcom_rdn.do</a><br>
and enter "admin" into the bottom text entry field.<br>
<br>
Thanks,<br>
Kathleen<br>
<br>
<br>
</body>
</html>