<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1251">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Kelvin -- I understand and appreciate what you are trying to accomplish -- but two questions:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">(1) How does a CA know that a particular customer who requests a wildcard cert is, or is not, a "cloud service provider" AND will be using the wildcard cert for multiple customer sites? I guess if you repeat the phrase "The CA is made
aware that..." before your new language on cloud service providers then the CA only needs to act when it becomes aware that a customer who has a wildcard cert is using it as a cloud service provider that would mean the CA's obligations only kick in after "awareness"
(changes in CAPS):<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">7. The CA is made aware that a Wildcard Certificate has been used to authenticate a fraudulently misleading subordinate Fully-Qualified Domain Name, except when the Subscriber is a cloud service provider. The
CA SHALL revoke a Wildcard Certificate issued to cloud service provider within 5 days if THE CA IS MADE AWARE THAT THE CUSTOMER IS A COULD SERVICE PROVIDER AND US USING A WILDCARD CERTIFICATE TO SECURE COULD SERVICES AMONG MULTIPLE INDEPENDENT CUSTOMERS AND
the cloud service provider FAILS TO provide evidence of the following A REQUEST FROM THE CA:<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in"><o:p> </o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">THAT THE COULD SERVICE PROVIDER:<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">1. Maintains a process that identifies potentially misleading subordinate domain names for additional approval<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">2. Regularly monitors the Domain Namespace for fraudulent activities<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">3. The fraudulent activities has been removed, or will investigate and remove the fraudulent activities within 24 hours upon notification by the CA<o:p></o:p></p>
<p class="MsoPlainText" style="margin-left:.5in">4. Asserts that the Private Key corresponding to the Public Key in the Wildcard Certificate has not been compromised<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">(2) As to the “evidence” a cloud service provider must provide to the CA – I’m guessing it will be merely assertions that the provider has a “process” and/or the provider’s terms of service for its customers forbid fraud – kind of hard
for a CA to monitor or verify. Also – why do CAs need to request a (one-time) assertion from the cloud service customer that its Private Key has not been compromised?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Kelvin Yiu<br>
Sent: Friday, May 23, 2014 11:49 AM<br>
To: Rick Andrews; richard.smith@comodo.com; public@cabforum.org<br>
Subject: Re: [cabfpub] Use of wildcard certificates by cloud operators</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">That's correct. The cloud operator would have to meet all 4 requirements.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I would like to know the type of evidence CAs would need for #1 and #2.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Kelvin<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">From: Rick Andrews [mailto:Rick_Andrews@symantec.com]<o:p></o:p></p>
<p class="MsoPlainText">Sent: Friday, May 23, 2014 11:01 AM<o:p></o:p></p>
<p class="MsoPlainText">To: Kelvin Yiu; richard.smith@comodo.com; public@cabforum.org<o:p></o:p></p>
<p class="MsoPlainText">Subject: RE: [cabfpub] Use of wildcard certificates by cloud operators<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Just to be clear, Kelvin, the CA SHALL revoke the cert if the cloud service provider doesn't provide evidence of ALL of the four items you listed.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-Rick<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Kelvin Yiu<o:p></o:p></p>
<p class="MsoPlainText">Sent: Friday, May 23, 2014 10:03 AM<o:p></o:p></p>
<p class="MsoPlainText">To: richard.smith@comodo.com; public@cabforum.org<o:p></o:p></p>
<p class="MsoPlainText">Subject: Re: [cabfpub] Use of wildcard certificates by cloud operators<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks Rich.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I want to make a change before moving forward with a ballot since I didn't specify any time periods in my previous draft. Here is the updated section 13.1.5.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">7. The CA is made aware that a Wildcard Certificate has been used to authenticate a fraudulently misleading subordinate Fully-Qualified Domain Name, except when the Subscriber is a cloud service provider. The CA SHALL revoke a Wildcard
Certificate issued to cloud service provider within 5 days if the cloud service provider do not provide evidence of the following:<o:p></o:p></p>
<p class="MsoPlainText">1. Maintains a process that identifies potentially misleading subordinate domain names for additional approval<o:p></o:p></p>
<p class="MsoPlainText">2. Regularly monitors the Domain Namespace for fraudulent activities<o:p></o:p></p>
<p class="MsoPlainText">3. The fraudulent activities has been removed, or will investigate and remove the fraudulent activities within 24 hours upon notification by the CA<o:p></o:p></p>
<p class="MsoPlainText">4. Asserts that the Private Key corresponding to the Public Key in the Wildcard Certificate has not been compromised<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Thanks,<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Kelvin<o:p></o:p></p>
<p class="MsoPlainText"><o:p></o:p></p>
<p class="MsoPlainText">-----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">From: Rich Smith [mailto:richard.smith@comodo.com]<o:p></o:p></p>
<p class="MsoPlainText">Sent: Friday, May 23, 2014 7:26 AM<o:p></o:p></p>
<p class="MsoPlainText">To: Kelvin Yiu; public@cabforum.org<o:p></o:p></p>
<p class="MsoPlainText">Subject: RE: [cabfpub] Use of wildcard certificates by cloud operators<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Kelvin,<o:p></o:p></p>
<p class="MsoPlainText">Thanks, this looks good to me. I'll endorse.<o:p></o:p></p>
<p class="MsoPlainText">Regards,<o:p></o:p></p>
<p class="MsoPlainText">Rich<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> -----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">> From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org]<o:p></o:p></p>
<p class="MsoPlainText">> On Behalf Of Kelvin Yiu<o:p></o:p></p>
<p class="MsoPlainText">> Sent: Thursday, May 22, 2014 8:09 PM<o:p></o:p></p>
<p class="MsoPlainText">> To: public@cabforum.org<o:p></o:p></p>
<p class="MsoPlainText">> Subject: Re: [cabfpub] Use of wildcard certificates by cloud operators<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Here is my first stab at the changes. The redline version is attached.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Change the first 2 paragraphs in section 11.1.3 to:<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Before issuing a certificate with a wildcard character (*) in a CN or
<o:p></o:p></p>
<p class="MsoPlainText">> subjectAltName of type DNS-ID, the CA MUST establish and follow a
<o:p></o:p></p>
<p class="MsoPlainText">> documented procedure† that determines if the wildcard character occurs
<o:p></o:p></p>
<p class="MsoPlainText">> in the first label position to the left of a public “registry-
<o:p></o:p></p>
<p class="MsoPlainText">> controlled” label (e.g. “*.com”, “*.co.uk”). CAs may consult with
<o:p></o:p></p>
<p class="MsoPlainText">> “public suffix lists” to identify public “registry-controlled” domains.<o:p></o:p></p>
<p class="MsoPlainText">> See RFC 6454 Section 8.2 for further explanation).<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> If a wildcard would fall within the label immediately to the left of a
<o:p></o:p></p>
<p class="MsoPlainText">> public “registry-controlled” domain†, CAs MUST refuse issuance unless
<o:p></o:p></p>
<p class="MsoPlainText">> the applicant proves its rightful control of the entire Domain
<o:p></o:p></p>
<p class="MsoPlainText">> Namespace. (e.g. CAs MUST NOT issue “*.co.uk” or “*.com”, but MAY
<o:p></o:p></p>
<p class="MsoPlainText">> issue “*.example.com” to Example Co.). Domains registered to cloud
<o:p></o:p></p>
<p class="MsoPlainText">> service providers or Internet hosting service providers are not
<o:p></o:p></p>
<p class="MsoPlainText">> considered to be public if the provider maintains reasonable controls
<o:p></o:p></p>
<p class="MsoPlainText">> to monitor its Domain Namespace for fraudulent activities and remove
<o:p></o:p></p>
<p class="MsoPlainText">> any fraudulent Subdomains.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Change #7 of section 13.1.5 to:<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> 7. The CA is made aware that a Wildcard Certificate has been used to
<o:p></o:p></p>
<p class="MsoPlainText">> authenticate a fraudulently misleading subordinate Fully-Qualified
<o:p></o:p></p>
<p class="MsoPlainText">> Domain Name;, except when the Subscriber is a cloud service provider.<o:p></o:p></p>
<p class="MsoPlainText">> The CA SHALL revoke a Wildcard Certificate issued to cloud service
<o:p></o:p></p>
<p class="MsoPlainText">> provider within nn days if the cloud service provider do not provide
<o:p></o:p></p>
<p class="MsoPlainText">> evidence of the following:<o:p></o:p></p>
<p class="MsoPlainText">> a. Maintains a process that identifies potentially misleading<o:p></o:p></p>
<p class="MsoPlainText">> subordinate domain names for additional approval<o:p></o:p></p>
<p class="MsoPlainText">> b. Regularly monitors the Domain Namespace for fraudulent<o:p></o:p></p>
<p class="MsoPlainText">> activities<o:p></o:p></p>
<p class="MsoPlainText">> c. The fraudulent activities has been removed, or will<o:p></o:p></p>
<p class="MsoPlainText">> investigate and remove the fraudulent activities within nn hours upon
<o:p></o:p></p>
<p class="MsoPlainText">> notification by the CA<o:p></o:p></p>
<p class="MsoPlainText">> d. Asserts that the Private Key corresponding to the Public Key<o:p></o:p></p>
<p class="MsoPlainText">> in the Wildcard Certificate has not been compromised<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Thanks,<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> Kelvin<o:p></o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">Public mailing list<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:Public@cabforum.org"><span style="color:windowtext;text-decoration:none">Public@cabforum.org</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="https://cabforum.org/mailman/listinfo/public"><span style="color:windowtext;text-decoration:none">https://cabforum.org/mailman/listinfo/public</span></a><o:p></o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">Public mailing list<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:Public@cabforum.org"><span style="color:windowtext;text-decoration:none">Public@cabforum.org</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="https://cabforum.org/mailman/listinfo/public"><span style="color:windowtext;text-decoration:none">https://cabforum.org/mailman/listinfo/public</span></a><o:p></o:p></p>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>