<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0cm;
margin-right:0cm;
margin-bottom:8.0pt;
margin-left:0cm;
font-size:10.0pt;
font-family:"Cambria","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";
color:black;}
p.line867, li.line867, div.line867
{mso-style-name:line867;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
p.line874, li.line874, div.line874
{mso-style-name:line874;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
p.line862, li.line862, div.line862
{mso-style-name:line862;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
span.EmailStyle24
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle25
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle27
{mso-style-type:personal-reply;
font-family:"Arial","sans-serif";
color:windowtext;
text-decoration:none none;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-GB link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:windowtext;mso-fareast-language:EN-US'>Hi Ben,<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:windowtext;mso-fareast-language:EN-US'>Here’s an example for everyone.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:windowtext;mso-fareast-language:EN-US'>The Italian Business Registry provides an e-mail authentication mechanism for Italian companies (From roughly 2011 and I don’t have a link to hand). i.e. it’s deemed by them to be stronger and more convenient than other methods and it’s legally required. This means for Italy it’s not necessary to make any phone call which is the intention behind the rewording in the ballot. So this, in part, answers Erwann’s point on e-mail – Yes it’s good enough.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:windowtext;mso-fareast-language:EN-US'>Doug suggested making the remit wider for the future by allowing other methods and making the decision on the acceptable method be made by the appropriate QGIS, but rather thank stating QGIS which is limiting he suggested using the term from the forthcoming ISO 29003 definition i.e. a “Source of Authority”. i.e. If a source of authority starts to store Skype IDs as ‘official’ communication channels then we should relish the opportunity to use this as a method of verification. If the CABforum remains too prescriptive in our choices we’ll continue to see low adoption of EV. Rather than make our own rules we should allow best practice from any jurisdiction on what they agree as a method of communication within that jurisdiction. The one size fits all rule does not work across the planet. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:windowtext;mso-fareast-language:EN-US'>If it’s too early for this mind set change then that’s fine, but I’d personally rather weave in flexibility earlier rather than later as I’ve always been frustrated that EV has not been as successful as we all would want.<o:p></o:p></span></p><div><p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Kind Regards<o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'> <o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span style='font-size:9.0pt;font-family:"Arial","sans-serif"'>Steve</span><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:#0433FF'><o:p></o:p></span></p></div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Arial","sans-serif";color:windowtext;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext'>From:</span></b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>Ben Wilson<br><b>Sent:</b> 16 April 2014 16:33<br><b>To:</b> 'Erwann Abalea'; public@cabforum.org<br><b>Subject:</b> Re: [cabfpub] Ballot 122 - Verified Method of Communication<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>I think if anyone wants to propose that we go beyond email or POTS (to things like Messenger and Skype-Skype), then the proponent should put forth a ballot that explains the verification steps that would have to be performed to ensure the reliability of that communication process, and I would not want anyone to be holding a patent or patent application on that process. I was also hoping that we wouldn’t have to get into a debate about the vulnerabilities or merits of using email vs. those other methods. Also, if someone wants to layer those other methods (like video conferencing) on top of the other acceptable ones for use in other day-to-day communications, then I don’t think they should be prohibited, but I think that is another issue/discussion. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><b><span lang=EN-US style='font-family:"Tahoma","sans-serif";color:windowtext'>From:</span></b><span lang=EN-US style='font-family:"Tahoma","sans-serif";color:windowtext'> <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Erwann Abalea<br><b>Sent:</b> Wednesday, April 16, 2014 8:18 AM<br><b>To:</b> Ben Wilson; <a href="mailto:public@cabforum.org">public@cabforum.org</a><br><b>Subject:</b> Re: [cabfpub] Ballot 122 - Verified Method of Communication<o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-US><o:p> </o:p></span></p><div><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US>It can, but it's not mandatory. Skype to Skype doesn't, for example. Neither does XMPP, nor Yahoo Messenger, ...<br>My question was more: is an email address a "Verified Method of Communication"? Is it more verified than a Skype handle? Or a verified Twitter account?<br><br><o:p></o:p></span></p><pre><span lang=EN-US>-- <o:p></o:p></span></pre><pre><span lang=EN-US>Erwann ABALEA<o:p></o:p></span></pre><pre><span lang=EN-US><o:p> </o:p></span></pre><p class=MsoNormal><span lang=EN-US>Le 16/04/2014 15:37, Ben Wilson a écrit :<o:p></o:p></span></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Doesn't Skype interface with the ITU-T E.164 POTS network using a numbers-only assigned route?<o:p></o:p></span></p></div></div><div><div style='margin-bottom:8.0pt'><div class=MsoNormal align=center style='margin-bottom:0cm;margin-bottom:.0001pt;text-align:center'><span lang=EN-US><hr size=2 width="100%" align=center></span></div></div><p class=MsoNormal style='margin-bottom:12.0pt'><b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>From: </span></b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><a href="mailto:erwann.abalea@keynectis.com">Erwann Abalea</a></span><span lang=EN-US><br></span><b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Sent: </span></b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>4/16/2014 2:51 AM</span><span lang=EN-US><br></span><b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>To: </span></b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'><a href="mailto:public@cabforum.org">public@cabforum.org</a></span><span lang=EN-US><br></span><b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Subject: </span></b><span lang=EN-US style='font-size:11.0pt;font-family:"Calibri","sans-serif"'>Re: [cabfpub] Ballot 122 - Verified Method of Communication</span><span lang=EN-US><o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US>Is the ITU-T E.164 reference used to disallow Skype or similar services?<br>Is an email address considered more "verified" than a Skype/whatever identifier?<br><br><o:p></o:p></span></p><pre><span lang=EN-US>-- <o:p></o:p></span></pre><pre><span lang=EN-US>Erwann ABALEA<o:p></o:p></span></pre><pre><span lang=EN-US><o:p> </o:p></span></pre><p class=MsoNormal><span lang=EN-US>Le 15/04/2014 22:57, Ben Wilson a écrit :<o:p></o:p></span></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=line867><strong><span lang=EN style='font-family:"Arial","sans-serif"'>Ballot 122 - Verified Method of Communication</span></strong><span lang=EN style='font-family:"Arial","sans-serif"'> </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>The EV Guidelines Working Group has completed its review of Section 11.4.2 of the EV Guidelines (Telephone Number for Applicant’s Place of Business). The purpose of the review was to "develop a more international process for verifying contact information,” especially to transition away from a landline-centric focus. The purpose of Section 11.4.2 has been to ensure a means for communicating with an organization (to verify the authority of EV roles and ensure that it was appropriately aware of the certificate request) and to provide additional evidence of an organization's existence. This is maintained by the proposed replacement language. </span><span lang=EN-US><o:p></o:p></span></p><p class=line862><span lang=EN style='font-family:"Arial","sans-serif"'>Cecilia Kam of Symantec made the following motion, and Rich Smith from Comodo and Jeremy Rowley from DigiCert have endorsed it. </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>Motion Begins </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>1. Create a new definition for a "Verified Method of Communication" in the EV Guidelines: </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>" Verified Method of Communication: The use of a public telecommunication routing number (ITU-E.164-compliant fixed, mobile, fax, or SMS), an email address, or a postal delivery address, confirmed by the CA in accordance with Section 11.4.2 of the Guidelines as a reliable way of communicating with the Applicant." </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>2. DELETE Section 11.4.2 (Telephone Number for Applicant's Place of Business) and INSERT the following: </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>"11.4.2 Verified Method of Communication </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>(1) Verification Requirements: To assist in communicating with the Applicant and confirming that the Applicant is aware of and approves issuance, the CA MUST establish at least one Verified Method of Communication with the Applicant. </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>(2) Acceptable Methods of Verification: To verify a Verified Method of Communication with the Applicant, the CA MUST: </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span lang=EN style='font-size:12.0pt;font-family:"Arial","sans-serif"'>(A) Verify that the number or address belongs to the Applicant, or a Parent or Affiliate of the Applicant, by matching it with one of the Applicant’s Places of Business in: (i) records provided by the applicable phone company; (ii) a QGIS, QTIS, or QIIS; or (iii) a Verified Legal Opinion or Verified Accountant Letter; and </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span lang=EN style='font-size:12.0pt;font-family:"Arial","sans-serif"'>(B) Confirm the Verified Method of Communication by using it to obtain an affirmative response sufficient to enable a reasonable person to conclude that the Applicant, or a Parent or Affiliate of Applicant, can be contacted reliably by using the </span><span lang=EN-US style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Verified </span><span lang=EN style='font-size:12.0pt;font-family:"Arial","sans-serif"'>Method of Communication. </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>3. In subsection 11.13.1(1)(D), REPLACE "Telephone number for Place of Business" with "Verified Method of Communication." </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>4. REPLACE subsection 11.13.3(1)(C) with "The Verified Method of Communication required by Section 11.4.2, but still MUST perform the verification required by Section 11.4.2(2)(B);" </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>Motion Ends </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>The review period for this ballot shall commence at 2200 UTC on Tuesday, 15 April 2014, and will close at 2200 UTC on Tuesday, 22 April 2014. Unless the motion is withdrawn during the review period, the voting period will start immediately thereafter and will close at 2200 UTC on Tuesday, 29 April 2014. Votes must be cast by posting an on-list reply to this thread. </span><span lang=EN-US><o:p></o:p></span></p><p class=line862><span lang=EN style='font-family:"Arial","sans-serif"'>A vote in favor of the motion must indicate a clear 'yes' in the response. A vote against must indicate a clear 'no' in the response. A vote to abstain must indicate a clear 'abstain' in the response. Unclear responses will not be counted. The latest vote received from any representative of a voting member before the close of the voting period will be counted. Voting members are listed here: <a href="https://cabforum.org/members/">https://cabforum.org/members/</a> </span><span lang=EN-US><o:p></o:p></span></p><p class=line874><span lang=EN style='font-family:"Arial","sans-serif"'>In order for the motion to be adopted, two thirds or more of the votes cast by members in the CA category and greater than 50% of the votes cast by members in the browser category must be in favor. Also, at least six members must participate in the ballot, either by voting in favor, voting against, or abstaining. </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:windowtext'> </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br><br><o:p></o:p></span></p><pre><span lang=EN-US>_______________________________________________<o:p></o:p></span></pre><pre><span lang=EN-US>Public mailing list<o:p></o:p></span></pre><pre><span lang=EN-US><a href="mailto:Public@cabforum.org">Public@cabforum.org</a><o:p></o:p></span></pre><pre><span lang=EN-US><a href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></span></pre></blockquote><p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p></blockquote><p class=MsoNormal style='margin-bottom:0cm;margin-bottom:.0001pt'><span lang=EN-US style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p></div></div></body></html>