<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"Bradley Hand ITC";
panose-1:3 7 4 2 5 3 2 3 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">I don’t think the extended discussion of my proposed ballot (Ballot 134) on whether RFC 5280 applies to precerts has reached any clear consensus.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I’m thinking of amending Ballot 134 to read as follows (and we should amend the title of the ballot to be “Application of RFC 5280 to Precertificates” or something similar – no exemptions required).<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Here is my proposed new Ballot 134 – comments welcome.<o:p></o:p></p>
<pre style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></pre>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">Appendix B – Certificate Extensions (Normative)<u>;<b> Application of RFC 5280</b></u><b><o:p></o:p></b></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><b><o:p> </o:p></b></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none">This appendix specifies the requirements for Certificate extensions for Certificates generated after the Effective Date. ***<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><b><u>(5) Application of RFC 5280<o:p></o:p></u></b></p>
<pre style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></pre>
<pre style="margin-left:.5in"><b><u><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">For purposes of clarification, a Precertificate as described in RFC 6962 – Certificate Transparency shall not be considered to be a “certificate” subject to the requirements of RFC 5280 - <span style="color:black">Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile under these Baseline Requirements</span></span></u></b><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:black">.</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></pre>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><i><span style="font-size:14.0pt;font-family:"Bradley Hand ITC";color:#0F243E">Kirk R. Hall<o:p></o:p></span></i></b></p>
<p class="MsoNormal">Operations Director, Trust Services<o:p></o:p></p>
<p class="MsoNormal">Trend Micro<o:p></o:p></p>
<p class="MsoNormal">+1.503.753.3088<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Ben Wilson<br>
Sent: Wednesday, October 01, 2014 10:00 AM<br>
To: Ben Laurie; Brian Smith<br>
Cc: CABFPub<br>
Subject: Re: [cabfpub] Ballot for limited exemption to RFC 5280 for CTimplementation</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Will someone please provide me, on-list (or off-list), with a suggested course of action on how to bring closure to this issue with a ballot?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Ben Laurie<o:p></o:p></p>
<p class="MsoPlainText">Sent: Wednesday, October 1, 2014 10:50 AM<o:p></o:p></p>
<p class="MsoPlainText">To: Brian Smith<o:p></o:p></p>
<p class="MsoPlainText">Cc: CABFPub<o:p></o:p></p>
<p class="MsoPlainText">Subject: Re: [cabfpub] Ballot for limited exemption to RFC 5280 for CTimplementation<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On 26 September 2014 20:34, Brian Smith <<a href="mailto:brian@briansmith.org"><span style="color:windowtext;text-decoration:none">brian@briansmith.org</span></a>> wrote:<o:p></o:p></p>
<p class="MsoPlainText">> On Fri, Sep 26, 2014 at 3:54 AM, Ben Laurie <<a href="mailto:benl@google.com"><span style="color:windowtext;text-decoration:none">benl@google.com</span></a>> wrote:<o:p></o:p></p>
<p class="MsoPlainText">>> On 26 September 2014 07:43, Man Ho (Certizen) <<a href="mailto:manho@certizen.com"><span style="color:windowtext;text-decoration:none">manho@certizen.com</span></a>> wrote:<o:p></o:p></p>
<p class="MsoPlainText">>>> Does any existing certificate issuing software support "duplicate"<o:p></o:p></p>
<p class="MsoPlainText">>>> certificate (that mean the issuer, same serial number, same public
<o:p></o:p></p>
<p class="MsoPlainText">>>> key, same subject info.) in the system? If not, many CAs will not be
<o:p></o:p></p>
<p class="MsoPlainText">>>> able to issue pre-cert.<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> Pre-certs do not require duplication - you can always issue them via
<o:p></o:p></p>
<p class="MsoPlainText">>> an intermediate.<o:p></o:p></p>
<p class="MsoPlainText">><o:p> </o:p></p>
<p class="MsoPlainText">> Ben, most of my messages in this thread are about exactly that. The
<o:p></o:p></p>
<p class="MsoPlainText">> RFC is ambiguous (at best) about the what the issuer field of a
<o:p></o:p></p>
<p class="MsoPlainText">> precertificate signed by a precertificate signing certificate is.<o:p></o:p></p>
<p class="MsoPlainText">> Above, you've chosen one particular interpretation, which is probably
<o:p></o:p></p>
<p class="MsoPlainText">> what y'all intended when you wrote the RFC. But, the RFC doesn't
<o:p></o:p></p>
<p class="MsoPlainText">> actual say that. In particular, the RFC seems to say that the issuer
<o:p></o:p></p>
<p class="MsoPlainText">> field of the precertificate should be the subject of the final issuer,
<o:p></o:p></p>
<p class="MsoPlainText">> not the subject of the precertificate signing certificate. And then
<o:p></o:p></p>
<p class="MsoPlainText">> the precertificate signing certificate mechanism doesn't solve the
<o:p></o:p></p>
<p class="MsoPlainText">> duplicate serial number issue.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The RFC says:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">"If the Precertificate is not signed with the<o:p></o:p></p>
<p class="MsoPlainText"> CA certificate that will issue the final certificate, then the<o:p></o:p></p>
<p class="MsoPlainText"> TBSCertificate also has its issuer changed to that of the CA that<o:p></o:p></p>
<p class="MsoPlainText"> will issue the final certificate"<o:p></o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">Public mailing list<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:Public@cabforum.org"><span style="color:windowtext;text-decoration:none">Public@cabforum.org</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="https://cabforum.org/mailman/listinfo/public"><span style="color:windowtext;text-decoration:none">https://cabforum.org/mailman/listinfo/public</span></a><o:p></o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">Public mailing list<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:Public@cabforum.org"><span style="color:windowtext;text-decoration:none">Public@cabforum.org</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="https://cabforum.org/mailman/listinfo/public"><span style="color:windowtext;text-decoration:none">https://cabforum.org/mailman/listinfo/public</span></a><o:p></o:p></p>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>