<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I see. This is an existing problem in the guidelines and might be out of scope for this ballot since the ballot is only supposed to resolve the OID issue. However,
I don’t see this change as controversial. Should we modify the ballot to fix it or have that be part of the subsequent ballot?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Jeremy<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> piotr.matusiewicz@unizeto.pl [mailto:piotr.matusiewicz@unizeto.pl]
<br>
<b>Sent:</b> Friday, July 24, 2015 12:36 AM<br>
<b>To:</b> Jeremy Rowley<br>
<b>Cc:</b> Dean_Coclin@symantec.com; public@cabforum.org<br>
<b>Subject:</b> ODP: RE: [cabfpub] ODP: Re: IV OID Ballot 150<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Jeremy,</span>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">look at point </span>
<span style="font-family:"Arial",sans-serif">7.1.4.2.2. </span><span style="font-size:10.0pt;font-family:"Arial",sans-serif">when many SDN Fields is prohibited:</span>
<br>
<b><span style="font-size:10.0pt;font-family:"Arial",sans-serif">Prohibited if the subject:organizationName field is absent. </span></b>
<br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">For the IV Certificates doesn't have to be filled organizationName but they have to be fields
</span><span style="font-family:"Calibri",sans-serif">givenName and surname</span><span style="font-size:10.0pt;font-family:"Arial",sans-serif">.</span>
<br>
<br>
<span style="font-size:10.0pt;font-family:"Arial",sans-serif">-Piotr</span> <br>
<br>
<br>
<br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">Od: </span><span style="font-size:7.5pt;font-family:"Arial",sans-serif">Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com">jeremy.rowley@digicert.com</a>></span>
<br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">Do: </span><span style="font-size:7.5pt;font-family:"Arial",sans-serif">"<a href="mailto:piotr.matusiewicz@unizeto.pl">piotr.matusiewicz@unizeto.pl</a>" <<a href="mailto:piotr.matusiewicz@unizeto.pl">piotr.matusiewicz@unizeto.pl</a>>,
"<a href="mailto:Dean_Coclin@symantec.com">Dean_Coclin@symantec.com</a>" <<a href="mailto:Dean_Coclin@symantec.com">Dean_Coclin@symantec.com</a>></span>
<br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">DW: </span><span style="font-size:7.5pt;font-family:"Arial",sans-serif">"<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>" <<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>>,
"<a href="mailto:public@cabforum.org">public@cabforum.org</a>" <<a href="mailto:public@cabforum.org">public@cabforum.org</a>></span>
<br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">Data: </span><span style="font-size:7.5pt;font-family:"Arial",sans-serif">2015-07-23 18:08</span>
<br>
<span style="font-size:7.5pt;font-family:"Arial",sans-serif;color:#5F5F5F">Temat: </span><span style="font-size:7.5pt;font-family:"Arial",sans-serif">RE: [cabfpub] ODP: Re: IV OID Ballot 150</span>
<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="3" width="100%" noshade="" style="color:#A0A0A0" align="center">
</div>
<p class="MsoNormal"><br>
<br>
<br>
<span style="font-family:"Calibri",sans-serif;color:#004080">Hi Piotr, </span><br>
<span style="font-family:"Calibri",sans-serif;color:#004080"> </span> <br>
<span style="font-family:"Calibri",sans-serif;color:#004080">What is the inconsistency?
</span><br>
<span style="font-family:"Calibri",sans-serif;color:#004080"> </span> <br>
<span style="font-family:"Calibri",sans-serif;color:#004080">Jeremy</span> <br>
<span style="font-family:"Calibri",sans-serif;color:#004080"> </span> <br>
<b><span style="font-family:"Calibri",sans-serif">From:</span></b><span style="font-family:"Calibri",sans-serif">
<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [</span><a href="mailto:public-bounces@cabforum.org"><span style="font-family:"Calibri",sans-serif">mailto:public-bounces@cabforum.org</span></a><span style="font-family:"Calibri",sans-serif">]
<b>On Behalf Of </b><a href="mailto:piotr.matusiewicz@unizeto.pl">piotr.matusiewicz@unizeto.pl</a><b><br>
Sent:</b> Thursday, July 16, 2015 12:49 AM<b><br>
To:</b> <a href="mailto:Dean_Coclin@symantec.com">Dean_Coclin@symantec.com</a><b><br>
Cc:</b> <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>;
<a href="mailto:public@cabforum.org">public@cabforum.org</a><b><br>
Subject:</b> [cabfpub] ODP: Re: IV OID Ballot 150</span> <br>
<br>
<span style="font-family:"Arial",sans-serif">Dean,</span> <span style="font-family:"Arial",sans-serif">
<br>
After this change there will be inconsistency between Section 7.1.6.1 and Section 7.1.4.2.2. Subject Distinguished Name Fields.
<br>
Is any change for Section 7.1.4.2.2. (in scope of description of the requirements DN fields) planned?</span>
<br>
<span style="font-family:"Arial",sans-serif"><br>
regards</span> <span style="font-family:"Arial",sans-serif"><br>
-Piotr</span> <br>
<br>
<br>
<span style="font-family:"Arial",sans-serif;color:#5F5F5F"><br>
Od: </span><span style="font-family:"Arial",sans-serif">Dean Coclin <</span><a href="mailto:Dean_Coclin@symantec.com"><span style="font-family:"Arial",sans-serif">Dean_Coclin@symantec.com</span></a><span style="font-family:"Arial",sans-serif">></span>
<span style="font-family:"Arial",sans-serif;color:#5F5F5F"><br>
Do: </span><span style="font-family:"Arial",sans-serif">"</span><a href="mailto:public@cabforum.org"><span style="font-family:"Arial",sans-serif">public@cabforum.org</span></a><span style="font-family:"Arial",sans-serif">" <</span><a href="mailto:public@cabforum.org"><span style="font-family:"Arial",sans-serif">public@cabforum.org</span></a><span style="font-family:"Arial",sans-serif">></span>
<span style="font-family:"Arial",sans-serif;color:#5F5F5F"><br>
Data: </span><span style="font-family:"Arial",sans-serif">2015-07-16 00:33</span>
<span style="font-family:"Arial",sans-serif;color:#5F5F5F"><br>
Temat: </span><span style="font-family:"Arial",sans-serif">Re: [cabfpub] IV OID Ballot 150</span>
<span style="font-family:"Arial",sans-serif;color:#5F5F5F"><br>
Wysłane przez: </span><a href="mailto:public-bounces@cabforum.org"><span style="font-family:"Arial",sans-serif">public-bounces@cabforum.org</span></a>
<o:p></o:p></p>
<p class="MsoNormal" align="center" style="text-align:center"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="3" width="100%" noshade="" style="color:#A0A0A0" align="center">
</div>
<p class="MsoNormal"><br>
<br>
<br>
<span style="font-family:"Calibri",sans-serif;color:#004080"><br>
Based on input from Mads, we are going to make a slight modification to this ballot which I believe is not substantial enough to restart the ballot period. The change is noted in Green, below the part that is crossed out. A PDF is enclosed.</span>
<span style="font-family:"Calibri",sans-serif;color:#004080"><br>
</span> <span style="font-family:"Calibri",sans-serif;color:#004080"><br>
Voting will start tomorrow.</span> <span style="font-family:"Calibri",sans-serif;color:#004080">
<br>
</span> <span style="font-family:"Calibri",sans-serif;color:#004080"><br>
Thanks,<br>
Dean</span> <span style="font-family:"Calibri",sans-serif;color:#004080"><br>
</span> <span style="font-family:"Calibri",sans-serif;color:#004080"><br>
</span> <b><span style="font-family:"Tahoma",sans-serif"><br>
From:</span></b><span style="font-family:"Tahoma",sans-serif"> </span><a href="mailto:public-bounces@cabforum.org"><span style="font-family:"Tahoma",sans-serif">public-bounces@cabforum.org</span></a><span style="font-family:"Tahoma",sans-serif"> [</span><a href="mailto:public-bounces@cabforum.org"><span style="font-family:"Tahoma",sans-serif">mailto:public-bounces@cabforum.org</span></a><span style="font-family:"Tahoma",sans-serif">]
<b>On Behalf Of </b>Dean Coclin<b><br>
Sent:</b> Wednesday, July 08, 2015 5:12 PM<b><br>
To:</b> </span><a href="mailto:public@cabforum.org"><span style="font-family:"Tahoma",sans-serif">public@cabforum.org</span></a><b><span style="font-family:"Tahoma",sans-serif"><br>
Subject:</span></b><span style="font-family:"Tahoma",sans-serif"> [cabfpub] IV OID Ballot 150</span>
<span style="font-family:"Calibri",sans-serif"><br>
</span> <span style="font-family:"Calibri",sans-serif;color:#004080"><br>
I’m reintroducing this ballot based on the meeting in Zurich. I’ll write a separate ballot for the EV, and EV Code Signing OIDs.</span>
<span style="font-family:"Calibri",sans-serif;color:#004080"><br>
</span> <span style="font-family:"Calibri",sans-serif;color:#004080"><br>
I have highlighted changes to the existing language so hopefully everyone can see the changes. I’ve also enclosed a pdf version.</span>
<span style="font-family:"Calibri",sans-serif;color:#004080"><br>
</span> <span style="font-family:"Calibri",sans-serif;color:#004080"><br>
Endorsers: I assume you are still good with this? There are no changes.</span> <span style="font-family:"Calibri",sans-serif;color:#004080">
<br>
</span> <span style="font-family:"Calibri",sans-serif;color:#004080"><br>
Thanks,<br>
Dean</span> <span style="font-family:"Calibri",sans-serif;color:#004080"><br>
</span> <b><span style="font-family:"Calibri",sans-serif"><br>
Ballot 150-Addition of Optional OID for Individual Validation</span></b> <span style="font-family:"Calibri",sans-serif">
<br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
The following motion has been proposed by Dean Coclin of Symantec and endorsed by Jeremy Rowley of Digicert and Kirk Hall of Trend Micro</span>
<span style="font-family:"Calibri",sans-serif"><br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
-- MOTION BEGINS –</span> <span style="font-family:"Calibri",sans-serif"><br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
Modify section 1.2 of Baseline Requirements as follows:</span> <span style="font-family:"Calibri",sans-serif">
<br>
</span> <b><span style="font-family:"Calibri",sans-serif"><br>
1.2 Document Name and Identification</span></b> <span style="font-family:"Calibri",sans-serif">
<br>
This certificate policy (CP) contains the requirements for the issuance and management of publicly‐trusted SSL certificates, as adopted by the CA/Browser Forum.
<br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
The following Certificate Policy identifiers are reserved for use by CAs as an optional means of asserting compliance with this CP (OID arc 2.23.140.1.2) as follows:
<br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐forum(140) certificate‐policies(1) baseline‐ requirements(2) domain‐validated(1)} (2.23.140.1.2.1);
<br>
{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐forum(140) certificate‐policies(1) baseline‐ requirements(2) organization-validated(2)} (2.23.140.1.2.2) and</span>
<span style="font-family:"Calibri",sans-serif"><br>
{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐forum(140) certificate‐policies(1) baseline‐ requirements(2) individual-validated(3)} (2.23.140.1.2.3).</span>
<span style="font-family:"Calibri",sans-serif;color:#004080"><br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
Modify section 7.1.6.1 as follows:</span> <b><span style="font-family:"Calibri",sans-serif"><br>
7.1.6.1. Reserved Certificate Policy Identifiers </span></b><span style="font-family:"Calibri",sans-serif"><br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
This section describes the content requirements for the Root CA, Subordinate CA, and Subscriber Certificates, as they relate to the identification of Certificate Policy.
<br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
The following Certificate Policy identifiers are reserved for use by CAs as an optional means of asserting compliance with these Requirements as follows:
<br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐forum(140) certificate‐policies(1) baseline‐requirements(2) domain‐validated(1)} (2.23.140.1.2.1), if the Certificate complies with these Requirements but lacks Subject Identity Information that
is verified in accordance with either Section 3.2.2.1 or Section 3.2.3.</span> <span style="font-family:"Calibri",sans-serif">
<br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
If the Certificate asserts the policy identifier of 2.23.140.1.2.1, then it MUST NOT include organizationName, streetAddress, localityName, stateOrProvinceName, or postalCode in the Subject field.
<br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐forum(140) certificate‐policies(1) baseline‐requirements(2) organization-validated(2)} (2.23.140.1.2.2), if the Certificate complies with these Requirements and includes Subject Identity Information
that is verified in accordance with Section 3.2.2.1.</span> <span style="font-family:"Calibri",sans-serif">
<br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐forum(140) certificate‐policies(1) baseline‐requirements(2) individual-validated(3)} (2.23.140.1.2.3), if the Certificate complies with these Requirements and includes Subject Identity Information
that is verified in accordance with Section 3.2.3.</span> <span style="font-family:"Calibri",sans-serif">
<br>
</span> <s><span style="font-family:"Calibri",sans-serif"><br>
If the Certificate asserts the policy identifier of either 2.23.140.1.2.2<span style="color:#004080">
</span>or 2.23.140.1.2.3 , then it MUST also include organizationName, localityName, stateOrProvinceName (if applicable), and countryName in the Subject field.</span></s>
<span style="font-family:"Calibri",sans-serif"><br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
If the Certificate asserts the policy identifier of 2.23.140.1.2.2, then it MUST also include organizationName, localityName, stateOrProvinceName (if applicable), and countryName in the Subject field. If the Certificate asserts the policy identifier of 2.23.140.1.2.3,
then it MUST also include (i) either organizationName or givenName and surname, (ii) localityName, (iii) stateOrProvinceName (if applicable), and (iv) tcountryName in the Subject field</span>
<span style="font-family:"Calibri",sans-serif;color:#004080"><br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
If the ballot passes, the custodian of the Forum OIDs will be instructed to obtain the new OID for IV as indicated above.</span>
<span style="font-family:"Calibri",sans-serif"><br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
-- MOTION ENDS –</span> <span style="font-family:"Calibri",sans-serif"><br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
The review period for this ballot shall commence at 2200 UTC on Thursday <span style="color:#004080">
July</span> <span style="color:#004080">9</span>, 2015, and will close at 2200 UTC on Thursday
<span style="color:#004080">16</span> Ju<span style="color:#004080">ly</span> 2015. Unless the motion is withdrawn during the review period, the voting period will start immediately thereafter and will close at 2200 UTC on Thursday, 2<span style="color:#004080">3</span>
<span style="color:#004080">July</span> 2015. Votes must be cast by posting an on-list reply to this thread.</span>
<span style="font-family:"Calibri",sans-serif"><br>
A vote in favor of the motion must indicate a clear 'yes' in the response. A vote against must indicate a clear 'no' in the response. A vote to abstain must indicate a clear 'abstain' in the response. Unclear responses will not be counted. The latest vote received
from any representative of a voting member before the close of the voting period will be counted. Voting members are listed here:
</span><a href="https://cabforum.org/members/"><span style="font-family:"Calibri",sans-serif">https://cabforum.org/members/</span></a>
<span style="font-family:"Calibri",sans-serif"><br>
</span> <span style="font-family:"Calibri",sans-serif"><br>
In order for the motion to be adopted, two thirds or more of the votes cast by members in the CA category and greater than 50% of the votes cast by members in the browser category must be in favor. Quorum is currently nine (9) members– at least nine members
must participate in the ballot, either by voting in favor, voting against, or abstaining.</span>
<span style="font-family:"Calibri",sans-serif"><br>
[załącznik "Ballot 150r1.pdf" został usunięty przez użytkownika Piotr Matusiewicz/UNIZETO] [załącznik "smime.p7s" został usunięty przez użytkownika Piotr Matusiewicz/UNIZETO]
</span><span style="font-family:"Courier New"">_______________________________________________<br>
Public mailing list<u><span style="color:blue"><br>
</span></u></span><a href="mailto:Public@cabforum.org"><span style="font-family:"Courier New"">Public@cabforum.org</span></a><u><span style="color:blue"><br>
</span></u><a href="https://cabforum.org/mailman/listinfo/public"><span style="font-family:"Courier New"">https://cabforum.org/mailman/listinfo/public</span></a>
<o:p></o:p></p>
</div>
</body>
</html>