<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=gb2312"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:SimSun;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:"\@SimSun";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
text-align:justify;
text-justify:inter-ideograph;
font-size:10.5pt;
font-family:"Calibri","sans-serif";
mso-fareast-language:ZH-CN;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple style='text-justify-trim:punctuation'><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'>Thank you for the explanation. As you know, your application was already approved but it’s helpful to have this information for the future.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'><br>Best regards,<br>Dean Coclin<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal align=left style='text-align:left'><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> </span><span lang=ZH-CN style='font-size:10.0pt;font-family:SimSun'>张翼</span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> [mailto:zhangyi@cfca.com.cn] <br><b>Sent:</b> Thursday, July 16, 2015 2:32 AM<br><b>To:</b> management@cabforum.org; public@cabforum.org<br><b>Cc:</b> 'Geoff Keating'; Dean Coclin; '</span><span lang=ZH-CN style='font-size:10.0pt;font-family:SimSun'>赵宇</span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>'; '</span><span lang=ZH-CN style='font-size:10.0pt;font-family:SimSun'>业务部组</span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>'; '</span><span lang=ZH-CN style='font-size:10.0pt;font-family:SimSun'>林峰</span><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>'<br><b>Subject:</b> Discussion relate to "Government CA"<o:p></o:p></span></p></div></div><p class=MsoNormal align=left style='text-align:left'><o:p> </o:p></p><p class=MsoNormal>Hello everyone:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Below are contents from “2015-05-14 Minutes"<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>“<o:p></o:p></p><p class=MsoNormal>1. Membership Application, China Financial Certification Authority: We have received an application CFCA. IPR was signed and they appear to meet all the CA membership criteria. Dean to double check with the applicant to make sure the signed is authorized to sign on behalf of the company. Otherwise, the application was conditionally approved. Mat asked if there was a relationship between this entity and the Chinese Government and wondered if there were other Government owned CAs in the Forum. Atilla said that the Government CA of Turkey under Tubitak, is a Government owned CA. Mat thought it might be helpful to put those CAs in another category. Dean said Izenpe is also owned by the Spanish Government. Gerv asked if CFCA were a Government CA, would we treat their application differently? The answer from the floor was no. There is nothing in the bylaws that state that. Mat said it would be helpful to understand which companies are public and which are owned by Governments. Especially when security incidents occur, private companies may be motivated to act differently. Dean suggested we discuss this further on another call or F2F meeting and we approve this request as is. Kirk suggested we ask in our application whether or not it is a Government applicant. Gerv said it isn’t relevant to their application and we should not ask it there. A discussion ensued on who audits Government CAs because sometimes it’s not a 3rd party auditor but ended w/o conclusion. Mat said the cross signing habits of Government CAs and Company CAs are different and this should be noted for the browsers when managing the risk.<o:p></o:p></p><p class=MsoNormal>“<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This Minutes have discussions relate to "Government CA", Mat said "it would be helpful to understand which companies are public and which are owned by Governments. Especially when security incidents occur, private companies may be motivated to act differently." "the cross signing habits of Government CAs and Company CAs are different and this should be noted for the browsers when managing the risk."<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Let me clarify , CFCA is NOT a government CA.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Chinese government have a list of companies directly controlled by government, CFCA is not among them.<o:p></o:p></p><p class=MsoNormal>The Chinese company name of our company is "<span lang=ZH-CN style='font-family:SimSun'>中金金融认证中心</span>"<span lang=ZH-CN style='font-family:SimSun'>，</span> we can't use "<span lang=ZH-CN style='font-family:SimSun'>中国</span>"<span lang=ZH-CN style='font-family:SimSun'>（</span>China<span lang=ZH-CN style='font-family:SimSun'>）</span><span lang=ZH-CN> </span>in the Chinese company name registration because we are not a government company.<o:p></o:p></p><p class=MsoNormal>China have over 7 million government-employee or so called "civil servant", none of them work in CFCA, or in charge of CFCA.<o:p></o:p></p><p class=MsoNormal>CEO of CFCA, Ji XiaoJie, is not designated by Chinese government, none of CFCA's employee or director is designated by Chinese government.<o:p></o:p></p><p class=MsoNormal>CFCA is not cross signed with any other CA or government department, or government CA, actually CFCA is not cross signed with anyone, and have no plan of doing so.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>If need more proof or discussion we can put this into next conference. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>how do we define "Government CA"?<o:p></o:p></p><p class=MsoNormal>In China, Some CAs are Subordinate to Chinese government department and their CEO are designated by Chinese Government, I won't object if you guys want to define those CA as government CA. But CFCA is not like that.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Mat said " Government CAs and Company CAs are different and this should be noted for the browsers when managing the risk."<o:p></o:p></p><p class=MsoNormal>I'm not sure if this is the reason why apple do not process our EV root certificate inclusion application(We have no such problem with Microsoft, Mozilla and Google), is there a "government CA" mark on our company name?<o:p></o:p></p><p class=MsoNormal>Mat give me a feeling that apple may think so-called "Government CA" is ready to do dirty work, and ready to cover it up if incident happens. In this case, been treated as a "Government CA" is not fair.<o:p></o:p></p><p class=MsoNormal>(please remind me if this is not appropriate to discuss in forum mail-list)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Zhang Yi<o:p></o:p></p><p class=MsoNormal><b>Business Research Competent<o:p></o:p></b></p><p class=MsoNormal>China Financial Certification Authority <o:p></o:p></p><p class=MsoNormal>Business Department<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Address: Bldg. 2<span lang=ZH-CN style='font-family:SimSun'>，</span> #20<span lang=ZH-CN style='font-family:SimSun'>，</span> 14th Kechuang street, YiZhuang Economic-Technological Development Zone<span lang=ZH-CN style='font-family:SimSun'>，</span>Daxing District<span lang=ZH-CN style='font-family:SimSun'>，</span>Beijing , P. R. China<o:p></o:p></p><p class=MsoNormal>Postcode: 100176<o:p></o:p></p><p class=MsoNormal>TEL: +86 010-58903555<o:p></o:p></p><p class=MsoNormal>Mobile: +86 18510280028<o:p></o:p></p><p class=MsoNormal>Email: <a href="mailto:zhangyi@cfca.com.cn"><span style='color:windowtext'>zhangyi@cfca.com.cn</span></a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>