<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<font face="Calibri">Hi all,<br>
<br>
whether these OIDs are actually "optional" is arguable, given that
Microsoft is going to require CAs to include them in certificates.....<br>
They will be... "virtually optional" :)<br>
<br>
Adriano<br>
<br>
<br>
<br>
</font><br>
<div class="moz-cite-prefix">Il 17/07/2015 01:07, Jeremy Rowley ha
scritto:<br>
</div>
<blockquote
cite="mid:a844d456f39e432dafa0cd41b4ac3b84@EX1.corp.digicert.com"
type="cite">
<pre wrap="">You are welcome to propose that ballot, but I likely won't vote for it as long as the certificate type OIDs remain optional. If we aren't requiring the use of OIDs to separate types of certificates, I don't see a good reason to move organizationName to givenName and surname for IV certs.
Jeremy
-----Original Message-----
From: Rob Stradling [<a class="moz-txt-link-freetext" href="mailto:rob.stradling@comodo.com">mailto:rob.stradling@comodo.com</a>]
Sent: Thursday, July 16, 2015 3:49 PM
To: Jeremy Rowley; Dean Coclin; <a class="moz-txt-link-abbreviated" href="mailto:public@cabforum.org">public@cabforum.org</a>
Cc: Mads Egil Henriksveen
Subject: Re: [cabfpub] IV OID Ballot 150
Hi Jeremy. If we could do a separate ballot for "organizationName v.
givenName and surname" very soon, so that the next version of the BRs incorporates both changes (assuming both ballots pass), then OK.
Could this be ballot 151?
On 16/07/15 21:56, Jeremy Rowley wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I disagree with this. The point of this ballot is merely to refine the OIDs (which are still optional), not to discuss use of organizationName v. givenName and surname. That would need to be a separate ballot.
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a class="moz-txt-link-freetext" href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
On Behalf Of Rob Stradling
Sent: Thursday, July 16, 2015 4:48 AM
To: Dean Coclin; <a class="moz-txt-link-abbreviated" href="mailto:public@cabforum.org">public@cabforum.org</a>
Cc: Mads Egil Henriksveen
Subject: Re: [cabfpub] IV OID Ballot 150
On 13/07/15 22:54, Dean Coclin wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I have no idea. I didn't write that. It was in the original BRs and not part of the ballot.
</pre>
</blockquote>
<pre wrap="">
Ah, I see. I've searched the cabfman archives but I can't find where this idea originated.
I recall that ancient versions of Java used to have problems with Subject attributes that weren't explicitly supported. In the first version of the BRs, we probably cared about those Java versions; but now, not so much.
I think that ballot 150 should take the opportunity to:
- forbid Subject.organizationName
and
- require Subject.givenName
and
- require Subject.surname
...in IV certs.
</pre>
<blockquote type="cite">
<pre wrap="">-----Original Message-----
From: Rob Stradling [<a class="moz-txt-link-freetext" href="mailto:rob.stradling@comodo.com">mailto:rob.stradling@comodo.com</a>]
Sent: Thursday, July 09, 2015 4:37 AM
To: Dean Coclin; <a class="moz-txt-link-abbreviated" href="mailto:public@cabforum.org">public@cabforum.org</a>
Cc: Mads Egil Henriksveen
Subject: Re: [cabfpub] IV OID Ballot 150
On 09/07/15 07:59, Mads Egil Henriksveen wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Hi Dean
Section 7.1.4.2.2. Subject Distinguished Name Fields b) Certificate
Field: subject:organizationName (OID 2.5.4.10) says:
/Because Subject name attributes for individuals (e.g. givenName
(2.5.4.42) and surname (2.5.4.4)) are not broadly supported by
application software,
</pre>
</blockquote>
<pre wrap="">
Dean,
What does "not broadly supported by application software" actually mean here?
Do you have a list of specific application software that will reject a server certificate that contains givenName and surname in the Subject?
</pre>
<blockquote type="cite">
<pre wrap="">_the CA MAY use the subject:organizationName_ field to convey a
natural person Subject’s name or DBA./
This is apparently inconsistent with the last sentence in the ballot:
/If the Certificate asserts the policy identifier of either
2.23.140.1.2.2 or 2.23.140.1.2.3 , then _it MUST also include
organizationName_, localityName, stateOrProvinceName (if
applicable), and countryName in the Subject field/.
I assume it should still be possible to issue certificates to
individuals (natural persons) without requiring the use of
organizationName for holding the individuals name, but rather use
other subject attributes (?)
Regards
Mads
*From:*public-bounces@cabforum.org
[<a class="moz-txt-link-freetext" href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
*On Behalf Of *Dean Coclin
*Sent:* 8. juli 2015 23:12
*To:* <a class="moz-txt-link-abbreviated" href="mailto:public@cabforum.org">public@cabforum.org</a>
*Subject:* [cabfpub] IV OID Ballot 150
I’m reintroducing this ballot based on the meeting in Zurich. I’ll
write a separate ballot for the EV, and EV Code Signing OIDs.
I have highlighted changes to the existing language so hopefully
everyone can see the changes. I’ve also enclosed a pdf version.
Endorsers: I assume you are still good with this? There are no changes.
Thanks,
Dean
*Ballot 150-Addition of Optional OID for Individual Validation*
The following motion has been proposed by Dean Coclin of Symantec
and endorsed by Jeremy Rowley of Digicert and Kirk Hall of Trend
Micro
-- MOTION BEGINS –
Modify section 1.2 of Baseline Requirements as follows:
*1.2 Document Name and Identification*
This certificate policy (CP) contains the requirements for the
issuance and management of publicly‐trusted SSL certificates, as
adopted by the CA/Browser Forum.
The following Certificate Policy identifiers are reserved for use by
CAs as an optional means of asserting compliance with this CP (OID
arc
2.23.140.1.2) as follows:
{joint‐iso‐itu‐t(2) international‐organizations(23)
ca‐browser‐forum(140) certificate‐policies(1) baseline‐
requirements(2) domain‐validated(1)} (2.23.140.1.2.1);
{joint‐iso‐itu‐t(2) international‐organizations(23)
ca‐browser‐forum(140) certificate‐policies(1) baseline‐
requirements(2) organization-validated(2)} (2.23.140.1.2.2) and
{joint‐iso‐itu‐t(2) international‐organizations(23)
ca‐browser‐forum(140) certificate‐policies(1) baseline‐
requirements(2) individual-validated(3)} (2.23.140.1.2.3).
Modify section 7.1.6.1 as follows:
*7.1.6.1. Reserved Certificate Policy Identifiers *
This section describes the content requirements for the Root CA,
Subordinate CA, and Subscriber Certificates, as they relate to the
identification of Certificate Policy.
The following Certificate Policy identifiers are reserved for use by
CAs as an optional means of asserting compliance with these
Requirements as
follows:
{joint‐iso‐itu‐t(2) international‐organizations(23)
ca‐browser‐forum(140) certificate‐policies(1)
baseline‐requirements(2) domain‐validated(1)} (2.23.140.1.2.1), if
the Certificate complies with these Requirements but lacks Subject
Identity Information that is verified in accordance with either Section 3.2.2.1 or Section 3.2.3.
If the Certificate asserts the policy identifier of 2.23.140.1.2.1,
then it MUST NOT include organizationName, streetAddress,
localityName, stateOrProvinceName, or postalCode in the Subject field.
{joint‐iso‐itu‐t(2) international‐organizations(23)
ca‐browser‐forum(140) certificate‐policies(1)
baseline‐requirements(2) organization-validated(2)}
(2.23.140.1.2.2), if the Certificate complies with these
Requirements and includes Subject Identity Information that is verified in accordance with Section 3.2.2.1.
{joint‐iso‐itu‐t(2) international‐organizations(23)
ca‐browser‐forum(140) certificate‐policies(1)
baseline‐requirements(2) individual-validated(3)} (2.23.140.1.2.3),
if the Certificate complies with these Requirements and includes
Subject Identity Information that is verified in accordance with Section 3.2.3.
If the Certificate asserts the policy identifier of either
2.23.140.1.2.2or 2.23.140.1.2.3 , then it MUST also include
organizationName, localityName, stateOrProvinceName (if applicable),
and countryName in the Subject field.
If the ballot passes, the custodian of the Forum OIDs will be
instructed to obtain the new OID for IV as indicated above.
-- MOTION ENDS –
The review period for this ballot shall commence at 2200 UTC on
Thursday July 9, 2015, and will close at 2200 UTC on Thursday 16 July 2015.
Unless the motion is withdrawn during the review period, the voting
period will start immediately thereafter and will close at 2200 UTC
on Thursday, 23 July 2015. Votes must be cast by posting an on-list
reply to this thread.
A vote in favor of the motion must indicate a clear 'yes' in the
response. A vote against must indicate a clear 'no' in the response.
A vote to abstain must indicate a clear 'abstain' in the response.
Unclear responses will not be counted. The latest vote received from
any representative of a voting member before the close of the voting
period will be counted. Voting members are listed here:
<a class="moz-txt-link-freetext" href="https://cabforum.org/members/">https://cabforum.org/members/</a>
In order for the motion to be adopted, two thirds or more of the
votes cast by members in the CA category and greater than 50% of the
votes cast by members in the browser category must be in favor.
Quorum is currently nine (9) members– at least nine members must
participate in the ballot, either by voting in favor, voting against, or abstaining.
</pre>
</blockquote>
<pre wrap="">
--
Rob Stradling
Senior Research & Development Scientist COMODO - Creating Trust
Online
</pre>
</blockquote>
<pre wrap="">
--
Rob Stradling
Senior Research & Development Scientist COMODO - Creating Trust Online
Office Tel: +44.(0)1274.730505 Office Fax: +44.(0)1274.730909
<a class="moz-txt-link-abbreviated" href="http://www.comodo.com">www.comodo.com</a>
COMODO CA Limited, Registered in England No. 04058690 Registered Office:
3rd Floor, 26 Office Village, Exchange Quay,
Trafford Road, Salford, Manchester M5 3EQ
This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender by replying to the e-mail containing this attachment. Replies to this email may be monitored by COMODO for operational or business reasons. Whilst every endeavour is taken to ensure that e-mails are free from viruses, no liability can be accepted and the recipient is requested to use their own virus checking software.
_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<pre wrap="">
--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
Office Tel: +44.(0)1274.730505
Office Fax: +44.(0)1274.730909
<a class="moz-txt-link-abbreviated" href="http://www.comodo.com">www.comodo.com</a>
COMODO CA Limited, Registered in England No. 04058690 Registered Office:
3rd Floor, 26 Office Village, Exchange Quay,
Trafford Road, Salford, Manchester M5 3EQ
This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender by replying to the e-mail containing this attachment. Replies to this email may be monitored by COMODO for operational or business reasons. Whilst every endeavour is taken to ensure that e-mails are free from viruses, no liability can be accepted and the recipient is requested to use their own virus checking software.
_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<i><span style="font-family: Serif">Adriano Santoni</span></i>
</div>
</body>
</html>