<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">[Reposting with permission, and responding]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">If I understand your example and concern below, you are saying the one company Company 1 may end up getting certs (even with the name “Company 1” in the O field for OV and
EV certs) for a domain that is actually registered in WhoIs to Company 2, and Company 1 and Company 2 have no common corporate ownership and are not affiliates. Did I simplify the facts correctly?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">And you are saying in that situation Company 1 does not “own or control” the domain belonging to Company 2, so we should change the wording in BR 3.2.2.4 to recognize that
in the domain validation process there can be cases where the Applicant does not actually “own or control” the domain, such as the situation above. Did I (oversimplify) that correctly?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">If I have understood your statement of the problem being addressed, I don’t think I agree with your conclusion. If Company 1 is able to demonstrate practical “control” over
the domain being validated by current validation methods 2-6 (or revised validation methods 2-9), then to me “ownership or control” has been demonstrated by Company 1, even if there is no obvious connection between the Applicant (Company 1) and the registered
domain owner (Company 2). If Company 1 can respond to one of the permitted email addresses, or can do a practical demonstration for the domain being validated, to me that is sufficient “control” to provide the cert.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">If I have mischaracterized your comments, please excuse me.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">I don’t think the current language in BR 3.2.2.4 presents any problem we need to address. To me, the much bigger issue beyond the narrow wording of BR 3.2.2.4 is, who is the
“Applicant”, who automatically becomes the “Subscriber” after acceptance by the CA through the rest of the BRs. I think it
<u>must</u> be the company that owns the website (and the cert) in question – in this case, Company 1 above - and not any agent or web hoster who is handling matters for Company 1 (and also not the WhoIs Registrant in this example, Company 2).
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">If we add any ambiguity or flexibility to who is (or may be) the Applicant, than all the other references to the Applicant and later to the Subscriber in the BRs become very
unclear – in that case, who are we talking about, Company 1, the web hoster, or Company 2 – or yet someone else who has helped in getting the domain validation completed? In fact, the Applicant and Subscriber agree to massive obligations to the CA and to
the public under the rest of the BRs (and usually in the Subscriber Agreement between the Applicant/Subscriber and the CA), and we can’t afford any ambiguity about exactly who that is in all cases, even if the Applicant is helped by third parties as their
agents, such as web hosters.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Peter Bowen [mailto:pzbowen@gmail.com]
<br>
<b>Sent:</b> Thursday, November 19, 2015 5:19 PM<br>
<b>To:</b> Kirk Hall (RD-US)<br>
<b>Cc:</b> CABFPub (public@cabforum.org)<br>
<b>Subject:</b> Re: [cabfpub] New subject -- Applicant/Subscriber versus domain Registrant<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Kirk,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I think this has veered a little off course. The scenario you describe is not the one I'm worried about. Let me try to describe the scenario that I'm trying to ensure is clearly covered in the revised 3.2.2.4 (as it is a common scenario).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Contoso Ltd. registeres <a href="http://contoso.com">contoso.com</a>. All contacts in the whois data for
<a href="http://contoso.com">contoso.com</a> point to the Contoso Ltd corporate mailing address and all contact emails are
<a href="mailto:ckent@contoso.com">ckent@contoso.com</a>.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Fabrikam, Inc. registeres <a href="http://fabrikam.com">fabrikam.com</a>. All contacts in the whois data for
<a href="http://fabrikam.com">fabrikam.com</a> point to the Fabrikam, Inc coporate mailing address and all contact emails are
<a href="mailto:bwayne@fabrikam.com">bwayne@fabrikam.com</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Example Service Corporation is a service provider located in Ames, Iowa in the United States.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Contoso, Fabrikam, and Example Service Co not affiliates of each other; they share no common ownership or control.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Example Service Corporation applies for a certificate with the Subject of "/C=US/ST=Iowa/L=Ames/O=Example Service Corporation" and two dNSNames in the subjectAltName extension:
<a href="http://images.contoso.com">images.contoso.com</a> and <a href="http://blog.fabrikam.com">
blog.fabrikam.com</a>. The CA operator first performs verification of Example Service Corporation according to the BRs. After this completing this verification, the CA sends emails to
<a href="mailto:ckent@contoso.com">ckent@contoso.com</a> and <a href="mailto:bwayne@fabrikam.com">
bwayne@fabrikam.com</a> to validate that Example Service Corporation has approval to get a certificate with the respective FQDNs. After each responds, the CA issues the certificate.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I think that this is a fairly standard process and is compliant with the BRs today. However the changes to 3.2.2.4 suggest that Line E (option 3) must show the "Applicant’s domain ownership or control". Some auditors or relying parties
might suggest that simply having the Registrant respond to the email may not prove that the Applicant is the 'owner' of the domain nor that the Applicant has control of the FQDN.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I am proposing the changes to ensure that it is clear that an email to the registrant alone is sufficient to meet the requirements.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Peter<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">(permission to repost is granted)<o:p></o:p></p>
</div>
</div>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>