<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
Good points. However, Appendix B(4) does say "all other <i><b>fields</b></i>
and extensions must be set in accordance with RFC 5280", making it
broader than just extensions. Since titles are not necessarily
considered restrictive on the scope of the guideline, an update to
this sentence is a good idea. I do realize that the scope says
"This appendix specifies the requirements for Certificate
extensions" so there is a conflict between the scope, the title, and
the actual wording. <br>
<br>
Jeremy<br>
<br>
<div class="moz-cite-prefix">On 9/18/2014 3:52 AM, Rob Stradling
wrote:<br>
</div>
<blockquote cite="mid:541AAB7B.3050006@comodo.com" type="cite">
<pre wrap="">On 18/09/14 03:01, <a class="moz-txt-link-abbreviated" href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a> wrote:
<snip>
</pre>
<blockquote type="cite">
<pre wrap="">Proposed amendments to Baseline Requirements.
New language is shown in */_bold , italics, and underlined._/*
1. Amend the Definitions as follows:
Valid Certificate:**A Certificate that passes the validation procedure
specified in RFC 5280 */_(except for the limited exemption provided in
Appendix B)._/*
</pre>
</blockquote>
<pre wrap="">
Kirk, this proposed change to the "Valid Certificate" definition makes
no sense to me at all.
I interpret "validation procedure specified in RFC 5280" to mean RFC5280
Section 6 (entitled "Certification Path Validation"), which has
absolutely nothing to say about duplicate serial numbers.
(The prohibition on duplicate serial numbers is in RFC5280 Section 4.1.2.2).
I think the "Valid Certificate" definition is intended to include all
certs that browsers accept, regardless of whether or not they've been
issued in full compliance with the BRs. (That's arguably an unfortunate
use of the word "Valid", but nonetheless I think this is the intent).
</pre>
<blockquote type="cite">
<pre wrap="">2. Amend Appendix B as follows:
Appendix B – Certificate Extensions (Normative/)_;*Limited Exemption
from Compliance with RFC 5280*_/**
</pre>
</blockquote>
<pre wrap="">
Again, this makes no sense. The serial number field is not a
certificate extension.
IMHO, the BRs, as written, don't actually incorporate the RFC5280
Section 4.1.2.2 rule prohibiting duplicate serial numbers.
We could fix this by changing the title of Appendix B to "Certificate
Fields and Extensions", but until we do that, your proposed limited
exemption is a no-op.
<snip>
</pre>
</blockquote>
<br>
</body>
</html>