<div dir="ltr">Rich,<div><br></div><div>Your original proposal didn't quite indicate the problem that you're trying to solve - or at least, the problem as you see it, and instead only presented the solution.</div><div>
<br></div><div>Is the issue something to do with the applicable namespace? Is it trying to designate additional entities as Enterprise RAs? </div><div><br></div><div>That is, I see a lot of problems with the proposal as written, and rather than trying to dissect them all, I'd like to try and understand what your end-goal is, to see how we can move there.</div>
<div><br></div><div>Cheers,</div><div>Ryan</div></div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Jan 17, 2014 at 11:30 AM, Rich Smith <span dir="ltr"><<a href="mailto:richard.smith@comodo.com" target="_blank">richard.smith@comodo.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">How about editing both to:<u></u><u></u></span></p>
<p class="MsoNormal">The CA MAY contractually authorize the Subject of a specified Valid Certificate to perform the RA function and authorize the CA to issue additional Certificates at ***the same or higher*** domain levels that are contained within the ***verified Domain Namespace*** of the original Certificate (also known as an Enterprise Certificate). In such case, the Subject SHALL be considered an Enterprise RA, and the following requirements SHALL apply:<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal">***<span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"> indicates where I made the changes.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">-Rich<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div><div style="border:none;border-top:solid #b5c4df 1.0pt;padding:3.0pt 0in 0in 0in"><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Jeremy Rowley [mailto:<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>] <br>
<b>Sent:</b> Friday, January 17, 2014 12:58 PM<br><b>To:</b> 'Ryan Sleevi'; 'Rich Smith'<br><b>Cc:</b> 'CABFPub'<br><b>Subject:</b> RE: [cabfpub] BR Enterprise RAs<u></u><u></u></span></p></div></div>
<div><div class="h5"><p class="MsoNormal"><u></u> <u></u></p><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d">Because the language comes straight from the EV Guidelines. Maybe we should update both at the same time?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1f497d"><u></u> <u></u></span></p><p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> <a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org" target="_blank">mailto:public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Ryan Sleevi<br>
<b>Sent:</b> Friday, January 17, 2014 10:26 AM<br><b>To:</b> Rich Smith<br><b>Cc:</b> CABFPub<br><b>Subject:</b> Re: [cabfpub] BR Enterprise RAs<u></u><u></u></span></p><p class="MsoNormal"><u></u> <u></u></p><p>Third or higher is insufficient for most ccTLDs (<a href="http://example.co.uk" target="_blank">example.co.uk</a>) or overly broad for gTLDs (foo.example).<u></u><u></u></p>
<p>Is there a reason you didn't simply refer to the registered domain name (and any preceding labels)?<u></u><u></u></p><p>That also covers the <a href="http://school.k12.wv.us" target="_blank">school.k12.wv.us</a> type registrations as well.<u></u><u></u></p>
<div><p class="MsoNormal">On Jan 17, 2014 9:19 AM, "Rich Smith" <<a href="mailto:richard.smith@comodo.com" target="_blank">richard.smith@comodo.com</a>> wrote:<u></u><u></u></p><div><div><p class="MsoNormal">
Colleagues,<u></u><u></u></p><p class="MsoNormal">In reviewing internal practices and BR compliance, we have discovered that the BRs seem to have a more restricted definition of what an Enterprise RA is allowed than the EV Guidelines. I think this is due simply to the wording of the BRs rather than specific intent. Because of that, I would like to propose the following amendment to the BRs. Please review and let me know if you are willing to endorse.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">----Motion Begins----<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal">Replace:<u></u><u></u></p><p>14.2.4 Enterprise RAs<u></u><u></u></p>
<p>The CA MAY designate an Enterprise RA to verify certificate requests from the Enterprise RA’s own organization.<u></u><u></u></p><p>The CA SHALL NOT accept certificate requests authorized by an Enterprise RA unless the following requirements are satisfied:<u></u><u></u></p>
<p>1. The CA SHALL confirm that the requested Fully-Qualified Domain Name(s) are within the Enterprise RA’s verified Domain Namespace (see Section 7.1.2 para 1).<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">With the following:<u></u><u></u></p><p>14.2.4 Enterprise RAs<u></u><u></u></p><p>The CA MAY contractually authorize the Subject of a specified Valid Certificate to perform the RA function and authorize the CA to issue additional Certificates at third and higher domain levels that are contained within the domain of the original Certificate (also known as an Enterprise Certificate). In such case, the Subject SHALL be considered an Enterprise RA, and the following requirements SHALL apply:<u></u><u></u></p>
<p>(1) An Enterprise RA SHALL NOT authorize the CA to issue an Enterprise Certificate at the third or higher domain levels to any Subject other than the Enterprise RA or a business that is owned or directly controlled by the Enterprise RA;<u></u><u></u></p>
<p>(2) In all cases, IF the Enterprise Certificate is to contain Organization details, the Subject of an Enterprise Certificate MUST be an organization verified by the CA in accordance with these Requirements; <u></u><u></u></p>
<p>(3) The CA MUST impose these limitations as a contractual requirement with the Enterprise RA and monitor compliance by the Enterprise RA; and,<u></u><u></u></p><p>(4) The audit requirements of Section 17.1 of these Requirements SHALL apply to the Enterprise RA, except in the case where the CA maintains control over the Root CA Private Key or Subordinate CA Private Key used to issue the Enterprise Certificates, in which case, the Enterprise RA MAY be exempted from the audit requirements. In the case that the Enterprise RA is granted a Technically Constrained Subordinate CA Key, Section 17.9 of these audit requirements shall apply to the Enterprise RA.<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:navy">-- </span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:navy">Regards,</span><u></u><u></u></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:navy">Rich Smith</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:navy">Validation Manager</span><u></u><u></u></p><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:navy">Comodo</span><u></u><u></u></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial","sans-serif";color:navy"><a href="http://www.comodo.com/" target="_blank">http://www.comodo.com</a></span><u></u><u></u></p><p class="MsoNormal">
<u></u><u></u></p><p class="MsoNormal"> <u></u><u></u></p></div></div><p class="MsoNormal" style="margin-bottom:12.0pt"><br>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><u></u><u></u></p></div></div></div></div></div></div></blockquote></div><br></div>