<HTML xmlns="http://www.w3.org/TR/REC-html40" xmlns:v = "urn:schemas-microsoft-com:vml" xmlns:o = "urn:schemas-microsoft-com:office:office" xmlns:w = "urn:schemas-microsoft-com:office:word" xmlns:m = "http://schemas.microsoft.com/office/2004/12/omml"><HEAD>
<META content="text/html; charset=utf-8" http-equiv=Content-Type>
<META name=Generator content="Microsoft Word 14 (filtered medium)">
<STYLE><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.line867, li.line867, div.line867
{mso-style-name:line867;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
p.line874, li.line874, div.line874
{mso-style-name:line874;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></STYLE>
</HEAD>
<BODY lang=EN-US link=blue vLink=purple>
<DIV>
<DIV style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif">I am not sure, maybe you're right, there was a draft that said that, but then there were minor criticisms about requiring things and expressly disclaiming warranties, and so I thought in order to move this forward, the CP/CPS requirement proposal had the best chance. Tomorrow morning I can circulate the version that modifies 7.1.2, but I'll wait for a few more people to chime in.</DIV></DIV>
<DIV dir=ltr>
<HR>
<SPAN style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif; FONT-WEIGHT: bold">From: </SPAN><SPAN style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif"><A href="mailto:Rick_Andrews@symantec.com">Rick Andrews</A></SPAN><BR><SPAN style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif; FONT-WEIGHT: bold">Sent: </SPAN><SPAN style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif">6/26/2014 6:04 PM</SPAN><BR><SPAN style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif; FONT-WEIGHT: bold">To: </SPAN><SPAN style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif"><A href="mailto:ben@digicert.com">Ben Wilson</A>; <A href="mailto:public@cabforum.org">'cabfpub'</A></SPAN><BR><SPAN style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif; FONT-WEIGHT: bold">Subject: </SPAN><SPAN style="FONT-SIZE: 11pt; FONT-FAMILY: Calibri,sans-serif">Re: [cabfpub] Pre-Ballot 125 - CAA Records</SPAN><BR><BR></DIV>
<DIV class=WordSection1>
<P class=MsoNormal><SPAN style="COLOR: #1f497d">Ben, I thought the group had decided to amend subparagraph 2 of 7.1.2 (Certificate Warranties). That’s the section that says at the time of issuance, CAs need to “consider” the CAA record (but “consider” could mean “ignore”). Did you intentionally exclude that?<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #1f497d"><o:p> </o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #1f497d">-Rick<o:p></o:p></SPAN></P>
<P class=MsoNormal><SPAN style="COLOR: #1f497d"><o:p> </o:p></SPAN></P>
<DIV>
<DIV style="BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; BORDER-BOTTOM: medium none; PADDING-BOTTOM: 0in; PADDING-TOP: 3pt; PADDING-LEFT: 0in; BORDER-LEFT: medium none; PADDING-RIGHT: 0in">
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><B><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: 'Tahoma','sans-serif'">From:</SPAN></B><SPAN style="FONT-SIZE: 10pt; FONT-FAMILY: 'Tahoma','sans-serif'"> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <B>On Behalf Of </B>Ben Wilson<BR><B>Sent:</B> Thursday, June 26, 2014 3:00 PM<BR><B>To:</B> 'cabfpub'<BR><B>Subject:</B> [cabfpub] Pre-Ballot 125 - CAA Records<o:p></o:p></SPAN></P></DIV></DIV>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><o:p> </o:p></P>
<P class=line867 style="MARGIN-LEFT: 0.5in"><STRONG><SPAN style="FONT-WEIGHT: normal">Based on our discussions over the last two months, I’m thinking that we are currently in a position to discuss something similar to the following as a ballot proposal. (FWIW - this is very similar to what Phill originally proposed back on January 8, 2013.)<o:p></o:p></SPAN></STRONG></P>
<P class=line867 style="MARGIN-LEFT: 0.5in"><STRONG>Pre-Ballot 125 - CAA Records</STRONG> <o:p></o:p></P>
<P class=line874 style="MARGIN-LEFT: 0.5in">Rick Andrews of Symantec made the following motion and Jeremy Rowley of Digicert and Ryan Sleevi of Google have endorsed it: <o:p></o:p></P>
<P class=line867 style="MARGIN-LEFT: 0.5in"><STRONG>Reasons for proposed ballot</STRONG> RFC 6844 defines a Certification Authority Authorization DNS Resource Record (CAA). A CAA allows a DNS domain name holder to specify the CAs authorized to issue certificates for that domain. Publication of the CAA allows a public Certification Authority to implement additional controls to reduce the risk of unintended certificate mis-issuance. <o:p></o:p></P>
<P class=line874 style="MARGIN-LEFT: 0.5in">The proponents of this ballot believe that this proposed modification to the Baseline Requirements, which gives CAs up to six months to update their CP and/or CPS to state the degree to which they implement CAA, provides all CAs with the flexibility needed to begin implementation of CAA. <o:p></o:p></P>
<P class=line867 style="MARGIN-LEFT: 0.5in"><STRONG>---MOTION BEGINS---</STRONG> <o:p></o:p></P>
<P class=line867 style="MARGIN-LEFT: 0.5in"><STRONG>Add to Section 4 Definitions, new item:</STRONG> <o:p></o:p></P>
<P class=line867 style="MARGIN-LEFT: 0.5in"><STRONG>CAA:</STRONG> From RFC 6844 (<A href="http://tools.ietf.org/html/rfc6844">http:tools.ietf.org/html/rfc6844</A>): “The Certification Authority Authorization (CAA) DNS Resource Record allows a DNS domain name holder to specify the Certification Authorities (CAs) authorized to issue certificates for that domain. Publication of CAA Resource Records allows a public Certification Authority to implement additional controls to reduce the risk of unintended certificate mis-issue.” <o:p></o:p></P>
<P class=line867 style="MARGIN-LEFT: 0.5in"><STRONG>Add a new sentence to the end of Section 8.2.2, Disclosure, as follows:</STRONG> <o:p></o:p></P>
<P class=line874 style="MARGIN-LEFT: 0.5in">Effective as of [insert date that is six months from Ballot 125 adoption], section 4.4.2 of a CA's Certificate Policy and/or Certification Practice Statement (subsection 4.1 for CA’s still conforming to RFC 2527) shall disclose the CA's policy and/or practices on processing CAA records. <o:p></o:p></P>
<P class=line874 style="MARGIN-LEFT: 0.5in"><B>The resulting Section 8.2.2 would read as follows:<o:p></o:p></B></P>
<P class=line874 style="MARGIN-LEFT: 0.5in">The CA SHALL publicly disclose its Certificate Policy and/or Certification Practice Statement through an appropriate and readily accessible online means that is available on a 24x7 basis. The CA SHALL publicly disclose its CA business practices to the extent required by the CA’s selected audit scheme (see Section 17.1). The disclosures MUST include all the material required by RFC 2527 or RFC 3647, and MUST be structured in accordance with either RFC 2527 or RFC 3647. <U>Effective as of [insert date that is six months from Ballot 125 adoption], section 4.4.2 of a CA's Certificate Policy and/or Certification Practice Statement (subsection 4.1 for CA’s still conforming to RFC 2527) shall disclose the CA's policy and/or practices on processing CAA records.<o:p></o:p></U></P>
<P class=line867 style="MARGIN-LEFT: 0.5in"><STRONG>---MOTION ENDS---</STRONG><o:p></o:p></P>
<P class=MsoNormal style="MARGIN-LEFT: 0.5in"><o:p> </o:p></P></DIV></BODY></HTML>