<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Peter – on the issue of membership, I still believe that anyone on your list could potentially apply for membership as a CA. However, one requirement is that the applicant
“</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">operates<span style="letter-spacing:-.45pt">
</span>a<span style="letter-spacing:-.1pt"> </span>certific<span style="letter-spacing:-.05pt">a</span>tion<span style="letter-spacing:-.6pt">
</span>authority”, which to me implies providing certificates to others (not just to the applicant’s own websites). So I would argue that an enterprise with an unconstrained sub-CA in its name that is used only for MPKI/EPKI is not operating a certification
authority and could not be a Member. After all, we cover standards for vetting, fraud prevention, etc. that are not relevant to MPKI/EPKI.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">If anyone thinks there is confusion on this point, maybe we need to add a membership limitation in the Bylaws that a CA and SubCA member must be a company that “operates
a certification authority <b><u>to issue SSL digital certificates to others</u></b>”, or similar language. Maybe I will add that to the Bylaws ballow.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Thanks for pointing this out.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif"">Kirk
</span><span style="font-size:11.0pt;font-family:"Calibri","sans-serif""><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>Ryan Sleevi<br>
<b>Sent:</b> Tuesday, March 24, 2015 8:40 AM<br>
<b>Cc:</b> CABFPub<br>
<b>Subject:</b> Re: [cabfpub] FW: Bylaw update proposal<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p>From Peter<o:p></o:p></p>
<div>
<p class="MsoNormal">On Mar 23, 2015 10:29 PM, "Peter Bowen" <<a href="mailto:pzbowen@gmail.com">pzbowen@gmail.com</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">On Mon, Mar 23, 2015 at 10:21 PM, Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a>> wrote:<br>
> On Mar 23, 2015 10:09 PM, "<a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a>"<br>
> <<a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a>> wrote:<br>
>> That’s a question for the browsers – Browsers, what do you say?<br>
><br>
> I'm not sure why this is a question for browsers - audit scope is audit<br>
> scope. Some CAs include subordinate CAs in scope of their own audits - such<br>
> as when they control and operate the infrastructure - other CAs don't.<br>
><br>
> Mozilla Root Inclusion Policy (Sections 8 and 10) require that unconstrained<br>
> subordinate CAs be disclosed and audited. Mozilla CA communications from May<br>
> 2014 [1] affirmed this.<br>
><br>
> I would expect that all of the CAs fall in one of the two buckets, and it's<br>
> up to their issuer to decide.<br>
><br>
> From the point of view of program operation, it does not make a difference<br>
> whether or not that subordinate is operated by a third party - have audit<br>
> and fill out the form, will travel.<br>
<br>
Here are two examples of CAs that are not Root CAs in any browser, and<br>
have issued multiple certificates according to CT logs:<br>
<br>
Unisys: <a href="http://uispki.unisys.com/rep/" target="_blank">http://uispki.unisys.com/rep/</a> (Current WebTrust for CA and BR<br>
linked at the bottom of the page)<br>
<br>
SSL.com: <a href="https://secure.comodo.com/products/publiclyDisclosedSubCACerts" target="_blank">
https://secure.comodo.com/products/publiclyDisclosedSubCACerts</a><br>
- serial 1100C5BF2758C19969FC68ED729DFCD7 (Audit info at top of page)<br>
<br>
(apologies for picking on both of these, but they were easy to find)<br>
<br>
Both are welcome to join and vote?<br>
<br>
Thanks,<br>
Peter<o:p></o:p></p>
</div>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>