<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>I'm not necessarily opposed, but I do get customers who specifically buy OV rather than EV certs because they operate different and competing brands as DBAs under a common corporate ownership, and don't want the relationship between the two brands disclosed. Generally tends to be something along the lines of a budget brand operating as DBA1 and a premium brand as DBA2. I guess this could be classified under misleading, but I don't think it's necessarily what we are talking about in terms of this thread. As I said, I'm not really opposed to this, and we've already adopted this for code signing for the reasons you've mentioned, but I do think that there may be some legitimate or at least semi-legitimate use cases which merit further discussion before making this a hard and fast rule to which every CA MUST adhere in every situation. Thoughts?<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>-Rich<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>Jeremy Rowley<br><b>Sent:</b> Tuesday, March 10, 2015 12:05 AM<br><b>To:</b> CABFPub<br><b>Subject:</b> [cabfpub] Assumed names and organization names<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>In the code signing working group, we’ve discussed abuses associated with assumed names and organization names. Names like “Click Here” or deceptive names like “Facebook” (when it’s not Facebook) can trick users into trusting a cert they otherwise wouldn’t use. <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>One suggestion to mitigate this issue is to require org names in certs be entered just like EV certificates – ie, the org name (including the Inc., LLC, etc) must be included along with an optional assumed name. Although this would primarily benefit code signing certificates (where names are readily displayed), this suggestion makes sense as a baseline requirement amendment since we really don’t want deceptive names in any certificates.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>What does everyone think about amending the baseline requirements so that certs including an org name must include the validated organization name in the O field?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Jeremy<o:p></o:p></p></div></div></body></html>