<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle18
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Thanks for forwarding this Ryan.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>I cannot speak for what the Forum intended, only what my interpretation is, but I did work on the document. When we finished up we didn’t receive many comments even though we strongly solicited them. The thought was that questions like Peter’s would tease out the details that needed more clarification and that we could amend the requirements based on such subsequent comments. We also have discussed tracking and working on these issues as they come up, either in GitHub or in Bugzilla.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>1 – Peter wrote, “This would appear to include OCSP responders, systems that store OCSP<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>responses, and repositories storing CRLs or certificates. This would<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>appear to make it very hard to use CDNs, as they are clearly storing<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>certificate status information but are not in a secure zone. Is this<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>the intent?”<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>CDNs are not part of this group of systems with higher security standards because (1) they are republishing status information that is stored elsewhere in other databases, and (2) they would be difficult to include in the scope of CA audits. That being said, CDNs still need to meet security standards because they provide status information to end users. One might expect auditors to ask CAs to provide a copy of the CDNs’ SOC 2 / SSAE 16 reports, and that CAs should be requesting copies of those from CDNs on an annual basis. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>2 – Peter also wrote, “There is also a requirement around remote administration or access to<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>certain systems (2.o). However "remote" is not defined. Does remote<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>mean access other than by connecting the system via a local console or<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>is there another definition of remote?”<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>As was discussed during the time leading up to the finalization of this requirement, some CAs have a remote way of connecting to the CA. The CA system is usually in a locked cage or vault that is difficult to access physically, because it requires that two people enter the room and stay while operations are being performed. (In this case, remote does not mean “local console”, as when you are on a private subnet that only connects the CA to the console via a cross-over Ethernet cable.) However, in most day-to-day operations, a CA is accessed “remotely”, and in that case I think it is pretty obvious that the CA system should not be directly accessible by IP address without an intermediary security access control system. Some have called such system a “jump host” or a “bastion host.” That’s what section 2.o explains.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Peter, do these answer your questions? Feel free to ask follow-up questions.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'>Ben<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>Ryan Sleevi<br><b>Sent:</b> Thursday, August 20, 2015 10:57 PM<br><b>To:</b> CABFPub <public@cabforum.org><br><b>Subject:</b> [cabfpub] Fwd: [CABFORUM] Questions on the network & certificate system security requirements<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>---------- Forwarded message ----------<br>From: <b>Peter Bowen</b> <<a href="mailto:pzbowen@gmail.com">pzbowen@gmail.com</a>><br>Date: Thu, Aug 20, 2015 at 9:17 PM<br>Subject: [CABFORUM] Questions on the network & certificate system security requirements<br>To: Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a>><br><br><br>I've gotten several different interpretations of the network security<br>requirements that are included in version 2 of the WebTrust SSL<br>Baseline with Network Security criteria (which are the Network and<br>Certificate System Security Requirements set forth by the CA/Browser<br>Forum). I have two questions:<br><br>According to the Requirements, each CA must maintain and protect<br>Issuing Systems, Certificate Management Systems, and Security Support<br>Systems in at least a Secure Zone (1.d), ensure that only personnel<br>assigned to Trusted Roles have access to Secure Zones and High<br>Security Zones (2.c), and apply the same security controls to all<br>systems co-located in the same zone with a Certificate System. (1.b).<br>"Certificate Management Systems" are systems to used process, approve<br>issuance of, or store certificates or certificate status information,<br>including the database, database server, and storage.<br><br>This would appear to include OCSP responders, systems that store OCSP<br>responses, and repositories storing CRLs or certificates. This would<br>appear to make it very hard to use CDNs, as they are clearly storing<br>certificate status information but are not in a secure zone. Is this<br>the intent?<br><br>There is also a requirement around remote administration or access to<br>certain systems (2.o). However "remote" is not defined. Does remote<br>mean access other than by connecting the system via a local console or<br>is there another definition of remote?<br><br>Thanks,<br>Peter<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>