<div dir="ltr"><div>I can't help but feel this is an attempt to subtlely reintroduce the discussions we've had at length in the past - in Zurich and in Istanbul - regarding complexities of domain ownership and who the O field should represent. If you recall, this discussion was primarily held with respect to EV validation and wildcard certs, but as many of the participants of those discussions noted, the problems here extend both to OV/IV certs.<br></div><div><br></div><div>We can and should presume that DV, given it's lack of information about the Subscriber/Applicant beyond the domain portion, is out of scope.</div><div><br></div><div>These discussions primarily used <a href="http://appspot.com">appspot.com</a> and <a href="http://azurewebsites.net">azurewebsites.net</a> when we were discussing, mostly because Jody, Gerv and I were all discussing things.</div><div><br></div><div>A few selected threads/discussions to refresh memory:</div><div>- <a href="https://cabforum.org/pipermail/public/2015-May/005623.html">https://cabforum.org/pipermail/public/2015-May/005623.html</a></div><div>- <a href="https://cabforum.org/2015/10/07/2015-10-07-face-to-face-meeting-minutes-meeting-36-istanbul/#EV-Wildcards">https://cabforum.org/2015/10/07/2015-10-07-face-to-face-meeting-minutes-meeting-36-istanbul/#EV-Wildcards</a></div><div>- <a href="https://cabforum.org/2015/06/24/2015-06-24-face-to-face-meeting-35-minutes/">https://cabforum.org/2015/06/24/2015-06-24-face-to-face-meeting-35-minutes/</a> (search for EVWC)</div><div><br></div><div><br></div><div>To recap those discussions, consider the following example: <a href="http://kirk.example.com">kirk.example.com</a></div><div><br></div><div>We discussed many of the parties that might be involved:</div><div>1) Kirk Hall, author of the content and logical operator of the <a href="http://kirk.example.com">kirk.example.com</a> origin</div><div>2) Example.com, provider of hosting services for Kirk Hall</div><div>3) CDN Corp, a CDN that provides SSL/TLS front-end services for <a href="http://example.com">example.com</a>, which does not offer them directly</div><div>4) Marketing Inc, the firm responsible for designing and maintaining the website on behalf of Kirk Hall</div><div>5) Payments LLC, the payment processing firm responsible for handling orders and financial details on <a href="http://kirk.example.com">kirk.example.com</a></div><div>6) DNS Org, the company who operates the DNS services on behalf of Kirk Hall</div><div>7) Mail Corp, the organization who handles the MX records that <a href="http://kirk.example.com">kirk.example.com</a> responds to</div><div><br></div><div>It is worth noting that under both the existing and proposed validation methods, any of these parties (but one) are entitled to obtain a certificate for <a href="http://kirk.example.com">kirk.example.com</a></div><div><br></div><div>1) Can use a file-based method on <a href="http://kirk.example.com">kirk.example.com</a>, or if control over DNS, add subrecords to establish validation</div><div>2) Can use validation based on the registerable domain portion (WHOIS)</div><div>3) Can use a file-based method on <a href="http://kirk.example.com">kirk.example.com</a> or a DNS based method</div><div>4) Can use a file-based method or equivalent</div><div>5) _Cannot_ obtain a certificate, unless they can get one of the other parties to make a suitable change on their behalf to satisfy a request</div><div>6) Can modify the DNS or respond to email (in the case of anonymized WHOIS that provides email forwarding services)</div><div>7) Can monitor/respond to emails as they come in</div><div><br></div><div>We know that CAs - and users - employ all of these methods today with publicly trusted CAs, and have for ... well, a long time. I don't believe the goal of the VWG was or is to somehow reform these - if that's the case, then it certainly hasn't been clearly communicated as such, and I think there might be louder opposition if so.</div><div><br></div><div>But to the problem at hand, what 'should' the information be presented as - whether this is O for OV or O for EV? As we've seen from the discussions on the calls, emails, and F2F, there isn't a clear consensus on there being 'one' right answer. We know that some CAs (and users) want the information presented to be who is operating the site, and we know that some CAs (and users) want it to be the person logically associated with the content. I don't think we'll resolve that here and now.</div><div><br></div><div>I think Peter's suggestions sound good, although I can fully understand and agree with your concerns that changing the language in localized parts requires thinking about how the BRs refer to things globally.</div><div><br></div><div>I think that the best way to resolve this is:</div><div>i) Recognize we don't have consensus yet for what the O field should present as</div><div>ii) Recognize that the VWG proposals provide many wonderful security benefits that we shouldn't let them get hungup on resolving i)</div><div>iii) Take a pass at the BRs, in their entirity, to find places where the language may be inconsistent with respect to the (unresolved) status quo, and update that language to reflect the present reality</div><div>iv) Longer term, if this is a topic members are passionate about, which I think we have evidence that some CAs are, work to build consensus as to those goals</div><div><br></div><div>Before we can do iii), we need some degree of agreement on i) and ii), and I should hope that should be easy to find, but do let me know if you disagree.</div><div><br></div><div><div class="gmail_extra"><div class="gmail_quote">On Thu, Nov 19, 2015 at 5:36 PM, <a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a> <span dir="ltr"><<a href="mailto:kirk_hall@trendmicro.com" target="_blank">kirk_hall@trendmicro.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">[Reposting with permission, and responding]<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">If I understand your example and concern below, you are saying the one company Company 1 may end up getting certs (even with the name “Company 1” in the O field for OV and
EV certs) for a domain that is actually registered in WhoIs to Company 2, and Company 1 and Company 2 have no common corporate ownership and are not affiliates. Did I simplify the facts correctly?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">And you are saying in that situation Company 1 does not “own or control” the domain belonging to Company 2, so we should change the wording in BR 3.2.2.4 to recognize that
in the domain validation process there can be cases where the Applicant does not actually “own or control” the domain, such as the situation above. Did I (oversimplify) that correctly?<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">If I have understood your statement of the problem being addressed, I don’t think I agree with your conclusion. If Company 1 is able to demonstrate practical “control” over
the domain being validated by current validation methods 2-6 (or revised validation methods 2-9), then to me “ownership or control” has been demonstrated by Company 1, even if there is no obvious connection between the Applicant (Company 1) and the registered
domain owner (Company 2). If Company 1 can respond to one of the permitted email addresses, or can do a practical demonstration for the domain being validated, to me that is sufficient “control” to provide the cert.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">If I have mischaracterized your comments, please excuse me.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">I don’t think the current language in BR 3.2.2.4 presents any problem we need to address. To me, the much bigger issue beyond the narrow wording of BR 3.2.2.4 is, who is the
“Applicant”, who automatically becomes the “Subscriber” after acceptance by the CA through the rest of the BRs. I think it
<u>must</u> be the company that owns the website (and the cert) in question – in this case, Company 1 above - and not any agent or web hoster who is handling matters for Company 1 (and also not the WhoIs Registrant in this example, Company 2).
<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif">If we add any ambiguity or flexibility to who is (or may be) the Applicant, than all the other references to the Applicant and later to the Subscriber in the BRs become very
unclear – in that case, who are we talking about, Company 1, the web hoster, or Company 2 – or yet someone else who has helped in getting the domain validation completed? In fact, the Applicant and Subscriber agree to massive obligations to the CA and to
the public under the rest of the BRs (and usually in the Subscriber Agreement between the Applicant/Subscriber and the CA), and we can’t afford any ambiguity about exactly who that is in all cases, even if the Applicant is helped by third parties as their
agents, such as web hosters.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11pt;font-family:Calibri,sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Peter Bowen [mailto:<a href="mailto:pzbowen@gmail.com" target="_blank">pzbowen@gmail.com</a>]
<br>
<b>Sent:</b> Thursday, November 19, 2015 5:19 PM<span class=""><br>
<b>To:</b> Kirk Hall (RD-US)<br>
<b>Cc:</b> CABFPub (<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>)<br>
</span><b>Subject:</b> Re: [cabfpub] New subject -- Applicant/Subscriber versus domain Registrant<u></u><u></u></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<div>
<p class="MsoNormal">Kirk,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I think this has veered a little off course. The scenario you describe is not the one I'm worried about. Let me try to describe the scenario that I'm trying to ensure is clearly covered in the revised 3.2.2.4 (as it is a common scenario).<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Contoso Ltd. registeres <a href="http://contoso.com" target="_blank">contoso.com</a>. All contacts in the whois data for
<a href="http://contoso.com" target="_blank">contoso.com</a> point to the Contoso Ltd corporate mailing address and all contact emails are
<a href="mailto:ckent@contoso.com" target="_blank">ckent@contoso.com</a>.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Fabrikam, Inc. registeres <a href="http://fabrikam.com" target="_blank">fabrikam.com</a>. All contacts in the whois data for
<a href="http://fabrikam.com" target="_blank">fabrikam.com</a> point to the Fabrikam, Inc coporate mailing address and all contact emails are
<a href="mailto:bwayne@fabrikam.com" target="_blank">bwayne@fabrikam.com</a><u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Example Service Corporation is a service provider located in Ames, Iowa in the United States.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Contoso, Fabrikam, and Example Service Co not affiliates of each other; they share no common ownership or control.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Example Service Corporation applies for a certificate with the Subject of "/C=US/ST=Iowa/L=Ames/O=Example Service Corporation" and two dNSNames in the subjectAltName extension:
<a href="http://images.contoso.com" target="_blank">images.contoso.com</a> and <a href="http://blog.fabrikam.com" target="_blank">
blog.fabrikam.com</a>. The CA operator first performs verification of Example Service Corporation according to the BRs. After this completing this verification, the CA sends emails to
<a href="mailto:ckent@contoso.com" target="_blank">ckent@contoso.com</a> and <a href="mailto:bwayne@fabrikam.com" target="_blank">
bwayne@fabrikam.com</a> to validate that Example Service Corporation has approval to get a certificate with the respective FQDNs. After each responds, the CA issues the certificate.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I think that this is a fairly standard process and is compliant with the BRs today. However the changes to 3.2.2.4 suggest that Line E (option 3) must show the "Applicant’s domain ownership or control". Some auditors or relying parties
might suggest that simply having the Registrant respond to the email may not prove that the Applicant is the 'owner' of the domain nor that the Applicant has control of the FQDN.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I am proposing the changes to ensure that it is clear that an email to the registrant alone is sufficient to meet the requirements.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Thanks,<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal">Peter<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">(permission to repost is granted)<u></u><u></u></p>
</div>
</div>
</div>
</div><div class=""><div class="h5">
<table><tbody><tr><td bgcolor="#ffffff"><font color="#000000"><pre><table><tbody><tr><td><pre>TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></tbody></table></pre></font></td></tr></tbody></table></div></div><br>_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" rel="noreferrer" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
<br></blockquote></div><br></div></div></div>