<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Calibri">I am fully in favour of improving the
revocation part of the BRs.<br>
<br>
In some of the circumstances listed under §13.1.5, revoking the
certificate "within 24 hours" is just unreasonable, as it might
not even allow the CA to start discussing the issue with the
certificate owner, which is something we believe must be done
(although in some cases such discussion would be very brief and
unilateral). Contact persons might be on a temporary leave, or
might have left the company, or might not be able to answer
email/telephone quickly enough. In some cases listed under 13.1.5,
revoking within 24 hours - without the certificate owner having
time to request a new certificate - might disrupt a major online
service causing troubles to many end users, which is not something
the certificate owner would forgive the CA for.<br>
<br>
Of course we comply with the current BRs, but we strongly believe
the BRs provisions for revocation deserve improvement, much like
Jeremy is proposing.<br>
<br>
Adriano<br>
<br>
</font><br>
<div class="moz-cite-prefix">Il 19/03/2015 15:20, Jeremy Rowley ha
scritto:<br>
</div>
<blockquote
cite="mid:eae2b207a9dc4bca9740207dcc3b5cb8@EX2.corp.digicert.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">Hi
everyone,<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">I
think the Baseline Requirements need improvements on how CAs
are required to handle certificate revocations, especially
if the certificate issue is reported by security
researchers. There needs to be a distinction between private
keys exposed through an attack and where private keys are
made vulnerable through an exploit (such as heartbleed). <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">For
incidents where the vulnerability has not been made public
or where there is an exploit affecting the general user
base, there should be a longer time period for revocation
than 24 hours. For private keys being malicious misused, we
should still have the 24 hour window. <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">The
length of time we permit for revocation should be strict
enough to prevent abuse but flexible enough to permit
investigation and patching in a timely manner. Plus, a less
strict revocation deadline would encourage CA participation
in the remediation efforts and reduce the panic created by a
high-profile vulnerability. Right now, the 24 hour
requirement is actually an incentive to exclude CAs from the
remediation process as not giving CAs notice provides more
time to remediate. <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">One
idea to make the revocation period flexible, something like
requiring the CA to provide notice that the certificate will
be revoked because of the reasons specified in Section
13.1.5 and then requiring revocation within one week after
the announcement of an industry vulnerability and within 72
hours after public disclosure of the vulnerability is made.
This gives CAs time to participate in the discussions and
ensures we still have a short revocation window for publicly
disclosed threats. Another idea is to simply expand the
time by up to two weeks if the revocation is part of
on-going investigation into an issue or a planned patch
process.<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thoughts?<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif"> <o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif">Jeremy<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<i><span style="font-family: Serif">Adriano Santoni</span></i> </div>
</body>
</html>