<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I don’t think there is an issue with using CDNs to provide CRL and OCSP responses. The CDN would have responses which were signed by the CA. The CDN does not
have to make the signature, just provide the signed response. I think this is very similar to OCSP Stapling, where server does not sign the OCSP response, but just serve it.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Of course if the signed response is compromised, then the verification would fail, per design.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Bruce.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>Ryan Sleevi<br>
<b>Sent:</b> Friday, August 21, 2015 12:57 AM<br>
<b>To:</b> CABFPub <public@cabforum.org><br>
<b>Subject:</b> [cabfpub] Fwd: [CABFORUM] Questions on the network & certificate system security requirements<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">---------- Forwarded message ----------<br>
From: <b>Peter Bowen</b> <<a href="mailto:pzbowen@gmail.com">pzbowen@gmail.com</a>><br>
Date: Thu, Aug 20, 2015 at 9:17 PM<br>
Subject: [CABFORUM] Questions on the network & certificate system security requirements<br>
To: Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a>><br>
<br>
<br>
I've gotten several different interpretations of the network security<br>
requirements that are included in version 2 of the WebTrust SSL<br>
Baseline with Network Security criteria (which are the Network and<br>
Certificate System Security Requirements set forth by the CA/Browser<br>
Forum). I have two questions:<br>
<br>
According to the Requirements, each CA must maintain and protect<br>
Issuing Systems, Certificate Management Systems, and Security Support<br>
Systems in at least a Secure Zone (1.d), ensure that only personnel<br>
assigned to Trusted Roles have access to Secure Zones and High<br>
Security Zones (2.c), and apply the same security controls to all<br>
systems co-located in the same zone with a Certificate System. (1.b).<br>
"Certificate Management Systems" are systems to used process, approve<br>
issuance of, or store certificates or certificate status information,<br>
including the database, database server, and storage.<br>
<br>
This would appear to include OCSP responders, systems that store OCSP<br>
responses, and repositories storing CRLs or certificates. This would<br>
appear to make it very hard to use CDNs, as they are clearly storing<br>
certificate status information but are not in a secure zone. Is this<br>
the intent?<br>
<br>
There is also a requirement around remote administration or access to<br>
certain systems (2.o). However "remote" is not defined. Does remote<br>
mean access other than by connecting the system via a local console or<br>
is there another definition of remote?<br>
<br>
Thanks,<br>
Peter<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>