<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Cambria-Bold;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Cambria-BoldItalic;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">(Reposting with permission, and also responding)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Peter – a good subject, but goes far beyond updating domain validation methods, so I suggest this not be mixed in with the domain validation pre-ballot. But probably worth
of its own separate discussion. Hence the new Subject line “New subject -- Applicant/Subscriber versus domain Registrant”<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">So far as I know, domain validation has always been established either by showing the customer as the Registrant in WhoIs (which I equate with “ownership” for easy reference,
even though we know there is no true ownership of a domain), or some means of practical demonstration of control over the domain (“control”), such as by responding to a challenge and response email to limited email addresses for the domain, or some other practical
demonstration – all demonstrations of “control”. We have never gotten hung up about who is actually responding – the Registrant/owner, or some agent (an employee, or a person working at a web hosting company). The main thing we are trying to do is confirm
that the person who requests a cert for the domain has some basis of right in getting the cert, and is not otherwise a “stranger” to the domain, like a hacker.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">To that end, if a particular customer has followed the “ownership or control” rules separately for, say, 10 domains, then I don’t see a problem in including all 10 domains
in a single cert issued to that same customer. After all, many corporations may operate through different subsidiaries or affiliates, and may show different Registrants for 10 domains (in some countries, it may only be possible to register the domain to a
local subsidiary and not to the foreign parent company).<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">In other cases, a domain owner (say, Foo Corporation which owns and uses foo.com) and its web hoster Zippy may be sloppy – the web hoster registers the domain “foo.com” for
its customer Foo Corp. but shows “Zippy” as the Registrant (so Zippy will get all notices), when it should have shown Foo Corporation as Registrant. I have seen that in the WhoIs records. If there is ever a dispute between Foo Corp. and Zippy as to who really
owns the domain, I predict Foo Corp. will win. However, in my opinion it’s not the job of CAs to sort out the business dealings between a domain owner and its web hoster on how the domain was registered, so long as the Applicant (applying for a certificate
as Foo Corporation) can show domain ownership or control in the ordinary way – even if the cert request is coming from the Applicant’s web hoster on the Applicant’s behalf. My belief is that Foo Corporation has equitable ownership or control of the domain
(and so is the “real” owner) even if there is another Registrant name in WhoIs – otherwise, if WhoIs is always the correct Registrant, there would be no need to use practical demonstration methods.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">If you are concerned that the web hoster is somehow in trouble by applying for a cert for a website owner, I think that’s already covered by the definition of Applicant Representative
(see below), who can be a third party (such as an employee of the web hoster) with authority to act for the website owner. The web hoster can get the authority from its website owner customer through its customer contract. For this reason I don’t think we
should make the changes you suggest (as they will totally mess up all the other uses and meaning of the term “Applicant” through the BRs).<o:p></o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">A natural person or human sponsor who is either the Applicant, employed by the Applicant,
<u>or an authorized agent who has express authority to represent the Applicant</u>: (i) who signs and submits, or approves a certificate request on behalf of the Applicant, and/or (ii) who signs and submits a Subscriber Agreement on behalf of the Applicant,
and/or (iii) who acknowledges and agrees to the Certificate Terms of Use on behalf of the Applicant when the Applicant is an Affiliate of the CA.</span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Peter Bowen [mailto:pzbowen@gmail.com]
<br>
<b>Sent:</b> Wednesday, November 18, 2015 1:15 PM<br>
<b>To:</b> Kirk Hall (RD-US)<br>
<b>Cc:</b> CABFPub (public@cabforum.org)<br>
<b>Subject:</b> Re: [cabfpub] FW: Question 3 – Domain Validation pre-ballot<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Kirk,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As you point out, the BRs make it very clear that the Applicant, Subscriber, and the organization identified in the subject field of the certificate (if one is identified) must be the same entity. However it is also clear that the practice
today is that the Applicant/Subscriber/Identified Subject Organziation need not be the same as the domain registrant. Please see the following examples:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://crt.sh/?id=6310788">https://crt.sh/?id=6310788</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://crt.sh/?id=10660016">https://crt.sh/?id=10660016</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://crt.sh/?id=8543179">https://crt.sh/?id=8543179</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://crt.sh/?id=9377019">https://crt.sh/?id=9377019</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://crt.sh/?id=5073196">https://crt.sh/?id=5073196</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://crt.sh/?id=10698172">https://crt.sh/?id=10698172</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://crt.sh/?id=7676342">https://crt.sh/?id=7676342</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Additionally, I think that it is clear that there must be exactly one Applicant/Subscriber for a certificate. If the Applicant/Subscriber has to be the Domain Name Registrant, then it is implied that all domains in a certificate must have
the same registrant. That would make these certificates impossible:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://crt.sh/?id=4703792">https://crt.sh/?id=4703792</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://crt.sh/?id=7313735">https://crt.sh/?id=7313735</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I am asking that it be made clear that the Applicant (who agrees to the Subscriber Agreement and is identified in the Subject, if there is Subject Identity Information) does not have to be the same entity as the Registrant.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Peter<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">(permission given to repost)<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Wed, Nov 18, 2015 at 11:02 AM, <a href="mailto:kirk_hall@trendmicro.com">
kirk_hall@trendmicro.com</a> <<a href="mailto:kirk_hall@trendmicro.com" target="_blank">kirk_hall@trendmicro.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">While I understand your point, I think it is (more or less) covered today by existing language elsewhere, and I don’t
think we should make the changes you suggest. Here are two beginning Definitions in the Baseline Requirements:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<b><span style="font-size:10.0pt;font-family:"Cambria-Bold",serif">Applicant: </span>
</b><span style="font-size:10.0pt;font-family:"Cambria",serif">The natural person or Legal Entity that applies for (or seeks renewal of) a Certificate. Once the Certificate issues, the Applicant is referred to as the Subscriber. For Certificates issued to devices,
the</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">Applicant is the entity that controls or operates the device named in the Certificate, even if the device is sending the actual certificate request.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<b><span style="font-size:10.0pt;font-family:"Cambria-Bold",serif">Applicant Representative:
</span></b><span style="font-size:10.0pt;font-family:"Cambria",serif">A natural person or human sponsor who is either the Applicant, employed by the Applicant,
<u>or an authorized agent who has express authority to represent the Applicant</u>: (i) who signs and submits, or approves a certificate request on behalf of the Applicant, and/or (ii) who signs and submits a Subscriber Agreement on behalf of the Applicant,
and/or (iii) who acknowledges and agrees to the Certificate Terms of Use on behalf of the Applicant when the Applicant is an Affiliate of the CA.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="font-size:10.0pt;font-family:"Cambria",serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<b><span style="font-size:10.0pt;font-family:"Cambria-Bold",serif">Subscriber Agreement</span></b><span style="font-size:10.0pt;font-family:"Cambria",serif">: An agreement between the CA and the Applicant/Subscriber that specifies the rights and responsibilities
of the parties.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<b><span style="font-size:10.0pt;font-family:"Cambria-Bold",serif">Subscriber: </span>
</b><span style="font-size:10.0pt;font-family:"Cambria",serif">A natural person or Legal Entity to whom a Certificate is issued and who is legally bound by a Subscriber or Terms of Use Agreement.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif">We also use the term Applicant in many other places in ways that make it clear the Applicant is the subject of the certificate being applied for, not the web hoster acting as the agent of the (real)
Applicant. For example, BR <a href="http://3.2.2.1" target="_blank">3.2.2.1</a>:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<b><i><span style="font-family:"Cambria-BoldItalic",serif">3.2.2.1. Identity</span></i></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">If the Subject Identity Information is to include the name or address of an organization, the CA SHALL verify</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">the identity and address of the organization and that the address
<u>is the Applicant’s address of existence</u> or</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">operation. The CA SHALL verify the identity and address
<u>of the Applicant</u> using documentation provided by,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">or through communication with, at least one of the following:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">1. A government agency in the jurisdiction of the
<u>Applicant’s</u> legal creation, existence, or recognition;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">2. A third party database that is periodically updated and considered a Reliable Data Source;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">3. A site visit by the CA or a third party who is acting as an agent for the CA; or</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">4. An Attestation Letter.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">The CA MAY use the same documentation or communication described in 1 through 4 above to verify both</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">the <u>Applicant’s</u> identity and address.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">Alternatively, the CA MAY verify the address of the
<u>Applicant</u> (but not the identity of the Applicant) using a</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">utility bill, bank statement, credit card statement, government‐issued tax document, or other form of</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">identification that the CA determines to be reliable.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">We also require important warranties from the “Applicant” including ongoing obligations – those are intended to bind
the domain owner as Applicant, and not the web hoster. Notice the underlined language below recognizes that an “agent” of the applicant may be authorized to agree to the warranty terms for the Applicant:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<b><span style="font-family:"Cambria-Bold",serif">9.6.3. Subscriber Representations and Warranties</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">The CA SHALL require, as part of the Subscriber or Terms of Use Agreement, that the Applicant make the</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">commitments and warranties in this section for the benefit of the CA and the Certificate Beneficiaries.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">Prior to the issuance of a Certificate, the CA SHALL obtain, for the express benefit of the CA and the Certificate</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">Beneficiaries, either:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">1. The Applicant’s agreement to the Subscriber Agreement with the CA, or</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">2. The Applicant’s agreement to the Terms of Use agreement. ***</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">The Subscriber or Terms of Use Agreement MUST contain provisions imposing on the Applicant itself (or</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<u><span style="font-size:10.0pt;font-family:"Cambria",serif">made by the Applicant on behalf of its principal or agent under a subcontractor or hosting service</span></u><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<u><span style="font-size:10.0pt;font-family:"Cambria",serif">relationship</span></u><span style="font-size:10.0pt;font-family:"Cambria",serif">) the following obligations and warranties:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">1. </span><b><span style="font-size:10.0pt;font-family:"Cambria-Bold",serif">Accuracy of Information:
</span></b><span style="font-size:10.0pt;font-family:"Cambria",serif">***</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">2. </span><b><span style="font-size:10.0pt;font-family:"Cambria-Bold",serif">Protection of Private Key: ***</span></b><span style="font-size:10.0pt;font-family:"Cambria",serif">;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">3. </span><b><span style="font-size:10.0pt;font-family:"Cambria-Bold",serif">Acceptance of Certificate: ***</span></b><span style="font-size:10.0pt;font-family:"Cambria",serif">;</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">4. </span><b><span style="font-size:10.0pt;font-family:"Cambria-Bold",serif">Use of Certificate:
</span></b><span style="font-size:10.0pt;font-family:"Cambria",serif">***</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="font-size:10.0pt;font-family:"Cambria",serif">5. </span><b><span style="font-size:10.0pt;font-family:"Cambria-Bold",serif">Reporting and Revocation:
</span></b><span style="font-size:10.0pt;font-family:"Cambria",serif">***</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Everyone is well aware that web hosters may act as agents for the (real) Applicant, and I think that is covered in
the existing definition of Applicant Representative (see underlined text). The assumption has always been that the web hoster has an agreement with the domain owner to apply for a cert in the owner’s name.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">So I don’t think we make things any better by amending the domain validation rules to use the phrase ““the Applicant’s
authorization to obtain and manage certificates for the Domain Namespace”” if that is intended to refer to the web hoster and not to the party that is the subject of the certificate – the party that “owns or controls” the domain itself. In fact, I think we
make things more confused when the Applicant in some cases in the domain owner, and in other cases the Applicant is a web hosting company itself (not just a web hosting company acting as the agent of the domain owner).</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">
<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Kirk Hall (RD-US)<br>
<b>Sent:</b> Wednesday, November 18, 2015 10:43 AM<br>
<b>To:</b> CABFPub (<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>)<br>
<b>Subject:</b> [cabfpub] FW: Question 3 – Domain Validation pre-ballot</span><o:p></o:p></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Peter Bowen [<a href="mailto:pzbowen@gmail.com" target="_blank">mailto:pzbowen@gmail.com</a>]
<br>
<b>Sent:</b> Tuesday, November 17, 2015 8:50 PM<br>
<b>To:</b> Kirk Hall (RD-US)<br>
<b>Cc:</b> CABFPub (<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>)<br>
<b>Subject:</b> Re: [cabfpub] Question 3 – Domain Validation pre-ballot</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">(you have my permission to repost to the public list)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Kirk,<o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">You bring up a good point about defining the Applicant. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I think that the definitions of "Subject" and "Subject Identity Information" in BR section 1.6 and the content of BR sections 3.2.2.1 and 7.4.1.2.2 make it clear that, for certificates
containing an organizationName attribute in the subject distinguished name, the subject organizationName identifies the certificate Applicant.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Assuming this is accurate, I have observed that most major CAs have issued certificates where the Applicant is clearly not the same as the Domain Name Registrant (i.e. owner) of
the Registered Domain Name. Most of these certificates appear to be issued to organizations that operate as web hosters. This strongly suggests that these CAs consider the web hoster to be the Applicant, not the Domain Name Registrant, and therefore the
legal promises are clearly made by the web hoster, not the Registrant.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">My rationale for the new phrase is to explicitly codify this widespread practice and document that the CA/Browser Forum recognizes that the Applicant need not be the same entity
as the Domain Name Registrant.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Peter<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Tue, Nov 17, 2015 at 6:31 PM,
<a href="mailto:kirk_hall@trendmicro.com" target="_blank">kirk_hall@trendmicro.com</a> <<a href="mailto:kirk_hall@trendmicro.com" target="_blank">kirk_hall@trendmicro.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Peter, I have tried to capture the changes you suggested in the attached documents, plus two choices of effective
date. (We will also have to make similar changes to EVGL 11.14.1 and 11.14.3 when we decide what to do about requiring revetting.)</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I am not sure I’m comfortable yet with going from the idea that we are confirming “the Applicant’s domain ownership
or control” (current language) to “the Applicant’s authorization to obtain and manage certificates for the Domain Namespace”. I think the current wording limits Applicant to the owner (or in some cases, licensee) of the domain, who can then work through
an agent to obtain a certificate. </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Your new phrase is kind of circular, and would treat an agent (web hoster or whatever) as the Applicant – but we
use Applicant lots of other places, including legal promises from the Applicant, and I am concerned that we are mixing roles – in some cases the Applicant really does own the domain and should be making the legal promises to the CA, browsers, etc., while in
other cases the Applicant could be just a third party agent who doesn’t own or control the domain, and the agent can’t and shouldn’t make legal promises as the “Applicant” for the actual domain owner.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Do you really think the new phrase “the Applicant’s authorization to obtain and manage certificates for the Domain
Namespace” adds any clarity? I’m afraid it would add some ambiguity. If we need to clarify that someone can act as Agent for the Applicant, we can do that, but only the Applicant should really be agreeing to the Subscriber Agreement, etc.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">If you want to respond, please email me and I will repost.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Peter Bowen [mailto:<a href="mailto:pzbowen@gmail.com" target="_blank">pzbowen@gmail.com</a>]
<br>
<b>Sent:</b> Saturday, November 14, 2015 1:31 PM<br>
<b>To:</b> Kirk Hall (RD-US)<br>
<b>Cc:</b> CABFPub (<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>)<br>
<b>Subject:</b> Re: [cabfpub] Question 3 – Domain Validation pre-ballot</span><o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Kirk,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thank you for the offer to forward comments to the group. Overall, I think that this is excellent work and I look forward to these becoming final. I agree that the current language
of Line J makes my comment moot. However, I do think there are a couple of other minor changes that would make the intent of validation clearer.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">In Line C, under (b), insert the words “or Affiliate of the CA” after “CA”. Many companies have different subsidiaries for different functions, so the Registrar and CA Operator
might not be the same legal entity, even if customers see them as the same.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">In Lines D, E, F, and G, replace "Confirming the Applicant’s domain ownership or control by" with "Confirming the Applicant’s authorization to obtain and manage certificates for
the Domain Namespace by”. This makes it clear that the purpose of the method is to confirm authorization and that Applicant does not have to be the same entity as the Domain Name Registrant.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">In Line B, insert “authorization, “ before “ownership” to reflect the change in D/E/F/G.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">It would also be good to clarify that the 6 months from ballot approval date is when CAs must cease to use non-compliant methods. CAs should be able to use any of the methods in
the ballot immediately upon approval. I think the ballot additionally should clarify if existing validations using a newly non-compliant method can be reused for 39 months (as per 3.3.1) or if CAs must cease relying upon the existing validations 6 months
from ballot approval.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Peter<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Thu, Nov 12, 2015 at 5:08 PM,
<a href="mailto:kirk_hall@trendmicro.com" target="_blank">kirk_hall@trendmicro.com</a> <<a href="mailto:kirk_hall@trendmicro.com" target="_blank">kirk_hall@trendmicro.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>Question 3 – Domain Validation pre-ballot</b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><u>Peter Bowen Comments</u></b>
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:#002060"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Peter Bowen of Amazon did not submit specific new language, but posed the following comment about new Method No. 7 shown below:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b> </b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<b>Proposal 3: In <u>line J</u> of current draft (Method No. 7)</b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<b> </b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
“In Item J, it suggests that the random token is only valid for a FQDN validation.
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
“I think DNS validation should be allowed for domain hierarchies in addition to specific FQDNs. A domain registrant should be able to choose to approve all FQDNs under
<a href="http://corp.example.com" target="_blank">corp.example.com</a> by adding a record for
<a href="http://corp.example.com" target="_blank">corp.example.com</a>.”<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<b> </b><o:p></o:p></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Here is the current Ballot language for Method No. 7:</span><o:p></o:p></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p style="margin-left:.5in"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">“7. Having the Applicant demonstrate control over the requested FQDN by the Applicant making a change to information in a DNS record for an Authorization Domain Name
where the change is to insert a Random Value or Request Token; or “</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<b> </b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I noted we had discussed before the problem of “<a href="http://kirkstore.shopping.com" target="_blank">kirkstore.shopping.com</a>” – Kirk might have control over the third level
FQDN, but might not have control over the SLDN (Base Domain) of <a href="http://shopping.com" target="_blank">
shopping.com</a>, so even though Kirk could demonstrate control for <a href="http://kirkstore.shopping.com" target="_blank">
kirkstore.shopping.com</a>, he should not use that to get a cert for <a href="http://shopping.com" target="_blank">
shopping.com</a>.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Doug Beattie thought that Peter might be misreading Authorization Domain Name, which is defined as follows:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<b><span style="color:black">“Authorization Domain Name</span></b><span style="color:black">: The Domain Name used to obtain authorization for certificate issuance or a given FQDN. The CA may use the FQDN returned from a DNS CNAME lookup as the FQDN for the
purposes of domain validation. If the FQDN starts with a wildcard character, then the CA MUST remove all wildcard labels from the left most portion of requested FQDN. The CA may prune zero or more labels from left to right until encountering a Base Domain
Name <u>and may use any one of the intermediate values for the purpose of domain validation.</u>“</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<b><span style="color:black">“Base Domain Name</span></b><span style="color:black">: The portion of an applied-for FQDN that is the first domain name node left of a registry-controlled or public suffix plus the registry-controlled or public suffix (e.g. “<a href="http://example.co.uk" target="_blank">example.co.uk</a>”
or “<a href="http://example.com" target="_blank">example.com</a>”). For gTLDs, the domain
<a href="http://www.%5BgTLD" target="_blank">www.[gTLD</a>] will be considered to be a Base Domain. “</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;text-autospace:none">
<span style="color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<b><u><span style="color:black">Questions for Discussion</span></u><span style="color:black">:
</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<b><span style="color:black"> </span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="color:black">(1) Is Doug correct that the <u>current</u> definition of Authorized Domain Name (see underlined text above) would already satisfy Peter’s suggestion that proving control of any FQDN by making a change to the DNS record for that FQDN
is sufficient to get a certificate for any lower level domain it contains, including the SLDN or Base Domain? If yes, are any changes needed?</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<span style="color:black">(2) More generally, do the members agree with Peter’s statement that “</span>A domain registrant should be able to choose to approve all FQDNs under
<a href="http://corp.example.com" target="_blank">corp.example.com</a> by adding a [DNS]record for
<a href="http://corp.example.com" target="_blank">corp.example.com</a>.” If not, do we need to change the definition of Authorization Domain Name to delete the language underlined above?<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<b><u>To Peter Bowen</u></b>: If you want to comment on this issue, please email to me and I will post to the Public list.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td style="background:white;padding:.75pt .75pt .75pt .75pt">
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt">
<pre>TREND MICRO EMAIL NOTICE<o:p></o:p></pre>
<pre>The information contained in this email and any attachments is confidential <o:p></o:p></pre>
<pre>and may be subject to copyright or other intellectual property protection. <o:p></o:p></pre>
<pre>If you are not the intended recipient, you are not authorized to use or <o:p></o:p></pre>
<pre>disclose this information, and we request that you notify us by reply mail or<o:p></o:p></pre>
<pre>telephone and delete the original message from your mail system.<o:p></o:p></pre>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
<div>
<div>
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td style="background:white;padding:.75pt .75pt .75pt .75pt">
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt">
<pre>TREND MICRO EMAIL NOTICE<o:p></o:p></pre>
<pre>The information contained in this email and any attachments is confidential <o:p></o:p></pre>
<pre>and may be subject to copyright or other intellectual property protection. <o:p></o:p></pre>
<pre>If you are not the intended recipient, you are not authorized to use or <o:p></o:p></pre>
<pre>disclose this information, and we request that you notify us by reply mail or<o:p></o:p></pre>
<pre>telephone and delete the original message from your mail system.<o:p></o:p></pre>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td style="background:white;padding:.75pt .75pt .75pt .75pt">
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt">
<pre> <o:p></o:p></pre>
<pre>TREND MICRO EMAIL NOTICE<o:p></o:p></pre>
<pre>The information contained in this email and any attachments is confidential <o:p></o:p></pre>
<pre>and may be subject to copyright or other intellectual property protection. <o:p></o:p></pre>
<pre>If you are not the intended recipient, you are not authorized to use or <o:p></o:p></pre>
<pre>disclose this information, and we request that you notify us by reply mail or<o:p></o:p></pre>
<pre>telephone and delete the original message from your mail system.<o:p></o:p></pre>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
<div>
<div>
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td style="background:white;padding:.75pt .75pt .75pt .75pt">
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt">
<pre>TREND MICRO EMAIL NOTICE<o:p></o:p></pre>
<pre>The information contained in this email and any attachments is confidential <o:p></o:p></pre>
<pre>and may be subject to copyright or other intellectual property protection. <o:p></o:p></pre>
<pre>If you are not the intended recipient, you are not authorized to use or <o:p></o:p></pre>
<pre>disclose this information, and we request that you notify us by reply mail or<o:p></o:p></pre>
<pre>telephone and delete the original message from your mail system.<o:p></o:p></pre>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>