<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Reposting with permission.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Is this sufficient reason to authorize .onion permanently?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Peter Bowen [mailto:pzbowen@gmail.com]
<br>
<b>Sent:</b> Sunday, November 22, 2015 11:51 AM<br>
<b>To:</b> Kirk Hall (RD-US)<br>
<b>Subject:</b> Re: [cabfpub] Extension of period allowing .onion certificates<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">(No need to forward this, but you can if you want)<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The basic premise is wrong. onion is listed as a Special-Use Domain Name (<a href="http://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml">http://www.iana.org/assignments/special-use-domain-names/special-use-domain-names.xhtml</a>)
based on publication of RFC 7686 (<a href="http://tools.ietf.org/html/rfc7686">http://tools.ietf.org/html/rfc7686</a>). <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The IETF tracker (<a href="https://datatracker.ietf.org/doc/rfc7686/">https://datatracker.ietf.org/doc/rfc7686/</a>) shows that it was submitted to IESG for publication and the IESG did publish. Therefore I think it is fair to state that
.onion is officially recognized by the IESG as a reserved TLD.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Sun, Nov 22, 2015 at 11:43 AM, <a href="mailto:kirk_hall@trendmicro.com">
kirk_hall@trendmicro.com</a> <<a href="mailto:kirk_hall@trendmicro.com" target="_blank">kirk_hall@trendmicro.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Last February the Forum passed Ballot 144 which allowed the issuance of .onion certs (even EV certs) through November 1, 2015. See ballot below. A key provision is Sec. 5 which
reads:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="color:black;background:white">5. CAs MUST NOT issue a Certificate that includes a Domain Name where .onion is in the right-most label of the Domain Name with a validity period longer than 15 months. Despite Section 9.2.1 of the Baseline Requirements
deprecating the use of Internal Names, a CA MAY issue a Certificate containing an .onion name with an expiration date later than 1 November 2015 after (and only if) .onion is officially recognized by the IESG as a reserved TLD.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
<span style="color:black;background:white"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:black;background:white">The IESG has not yet recognized .onion as a reserved TLD.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:black;background:white"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:black;background:white">Trend Micro voted against Ballot 144 because we were not comfortable with the security around vetting and uniqueness of a .onion domain
name. However, IESG has failed to act over the last nine months, and no problems or abuses have come to light for .onion certs. Trend Micro would favor a further extension until we get a definitive yes or no from IESG. Perhaps an additional nine months
would be appropriate. (Note: there is a clash today between allowing .onion certs and the prohibition against Internal Names, but that can’t be helped).</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:black;background:white"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:black;background:white">So we would endorse a ballot to extend.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="color:black;background:white"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">*****<o:p></o:p></p>
<p style="background:white"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Ballot 144</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">1) Amend Section 9.2.1 of the Baseline Requirements v. 1.2.3 as follows:</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">9.2.1 Subject Alternative Name Extension Certificate Field: extensions:subjectAltName Required/Optional: Required Contents:
This extension MUST contain at least one entry. Each entry MUST be either a dNSName containing the Fully-Qualified Domain Name or an iPAddress containing the IP address of a server. The CA MUST confirm that the Applicant controls the Fully-Qualified Domain
Name or IP address or has been granted the right to use it by the Domain Name Registrant or IP address assignee, as appropriate.</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Wildcard FQDNs are permitted. As of the Effective Date of these Requirements, prior to the issuance of a Certificate with
a subjectAlternativeName extension or Subject commonName field containing a Reserved IP Address or Internal Name, the CA SHALL notify the Applicant that the use of such Certificates has been deprecated by the CA / Browser Forum and that the practice will be
eliminated by October 2016. Also as of the Effective Date, the CA SHALL NOT issue a certificate with an Expiry Date later than 1 November 2015 with a subjectAlternativeName extension or Subject commonName field containing a Reserved IP Address or Internal
Name. Effective 1 October 2016, CAs SHALL revoke all unexpired Certificates whose subjectAlternativeName extension or Subject commonName field contains a Reserved IP Address or Internal Name. <u>Effective May 1, 2015, each CA SHALL revoke all unexpired Certificates
with an Internal Name using onion as the right-most label in an entry in the subjectAltName Extension or commonName field unless such Certificate was issued in accordance with Appendix F of the EV Guidelines.</u></span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">2) Amend Section 9.2.2 and 11.7.1 of the Guidelines for the Issuance and Management of Extended Validation Certificates
v1.5.2 as follows:</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">9.2.2. Subject Alternative Name Extension Certificate field: subjectAltName:dNSName Required/Optional: Required Contents:
This extension MUST contain one or more host Domain Name(s) owned or controlled by the Subject and to be associated with the Subject’s server. Such server MAY be owned and operated by the Subject or another entity (e.g., a hosting service). Wildcard certificates
are not allowed for EV Certificates<u> except as permitted under Appendix F</u>.</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">11.7 Verification of Applicant’s Domain Name</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">11.7.1. Verification Requirements</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">(1) For each Fully-Qualified Domain Name listed in a Certificate, <u>other than a Domain Name with .onion in the right-most
label of the Domain Name, </u>the CA SHALL confirm that, as of the date the Certificate was issued, the Applicant (or the Applicant’s Parent Company, Subsidiary Company, or Affiliate, collectively referred to as “Applicant” for the purposes of this section)
either is the Domain Name Registrant or has control over the FQDN using a procedure specified in Section 11.1.1 of the Baseline Requirements, except that a CA MAY NOT verify a domain using the procedure described 11.1.1(7). <u>For a Certificate issued to a
Domain Name with .onion in the right-most label of the Domain Name, the CA SHALL confirm that, as of the date the Certificate was issued, the Applicant’s control over the .onion Domain Name in accordance with Appendix F.</u></span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">(2) Mixed Character Set Domain Names: EV Certificates MAY include Domain Names containing mixed character sets only in
compliance with the rules set forth by the domain registrar. The CA MUST visually compare any Domain Names with mixed character sets with known high risk domains. If a similarity is found, then the EV Certificate Request MUST be flagged as High Risk. The CA
must perform reasonably appropriate additional authentication and verification to be certain beyond reasonable doubt that the Applicant and the target in question are the same organization.</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">3) Add a new Appendix F to the the Guidelines for the Issuance and Management of Extended Validation Certificates v1.5.2:</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Appendix F – Issuance of Certificates for .onion Domain Names</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">A CA may issue an EV Certificate with .onion in the right-most label of the Domain Name provided that issuance complies
with the requirements set forth in this Appendix: 1. CAB Forum Tor Service Descriptor Hash extension (2.23.140.1.31) The CAB Forum has created an extension of the TBSCertificate for use in conveying hashes of keys related to .onion addresses. The Tor Service
Descriptor Hash extension has the following format:</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">cabf-<a href="https://www.cabforum.org/wiki/TorServiceDescriptor" target="_blank"><span style="color:gray;border:none windowtext 1.0pt;padding:0in">TorServiceDescriptor</span></a> OBJECT
IDENTIFIER ::= { 2.23.140.1.31 }</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><a href="https://www.cabforum.org/wiki/TorServiceDescriptorSyntax" target="_blank"><span style="color:gray;border:none windowtext 1.0pt;padding:0in">TorServiceDescriptorSyntax</span></a> ::=</span><o:p></o:p></p>
<p style="mso-margin-top-alt:5.0pt;margin-right:0in;margin-bottom:3.0pt;margin-left:.5in;background:white">
<span style="font-size:10.0pt;font-family:Symbol;color:black">·</span><span style="font-size:7.0pt;color:black">
</span><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">SEQUENCE ( 1..MAX ) of <a href="https://www.cabforum.org/wiki/TorServiceDescriptorHash" target="_blank"><span style="color:gray;border:none windowtext 1.0pt;padding:0in">TorServiceDescriptorHash</span></a></span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black"><a href="https://www.cabforum.org/wiki/TorServiceDescriptorHash" target="_blank"><span style="color:gray;border:none windowtext 1.0pt;padding:0in">TorServiceDescriptorHash</span></a>::
= SEQUENCE {</span><o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="margin-left:6.0pt;border-collapse:collapse">
<tbody>
<tr>
<td style="border:solid #ADB9CC 1.0pt;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">onionURI</span><o:p></o:p></p>
</td>
<td style="border:solid #ADB9CC 1.0pt;border-left:none;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">UTF8String</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="border:solid #ADB9CC 1.0pt;border-top:none;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">algorithm</span><o:p></o:p></p>
</td>
<td style="border-top:none;border-left:none;border-bottom:solid #ADB9CC 1.0pt;border-right:solid #ADB9CC 1.0pt;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><a href="https://www.cabforum.org/wiki/AlgorithmIdentifier" target="_blank"><span style="color:gray;border:none windowtext 1.0pt;padding:0in">AlgorithmIdentifier</span></a></span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="border:solid #ADB9CC 1.0pt;border-top:none;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">subjectPublicKeyHash</span><o:p></o:p></p>
</td>
<td style="border-top:none;border-left:none;border-bottom:solid #ADB9CC 1.0pt;border-right:solid #ADB9CC 1.0pt;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">BIT STRING</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">}</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">Where the <a href="https://www.cabforum.org/wiki/AlgorithmIdentifier" target="_blank"><span style="color:gray;border:none windowtext 1.0pt;padding:0in">AlgorithmIdentifier</span></a> is
a hashing algorithm (defined in RFC 6234) performed over the DER-encoding of an ASN.1 <a href="https://www.cabforum.org/wiki/SubjectPublicKey" target="_blank"><span style="color:gray;border:none windowtext 1.0pt;padding:0in">SubjectPublicKey</span></a> of
the .onion service and<a href="https://www.cabforum.org/wiki/SubjectPublicKeyHash" target="_blank"><span style="color:gray;border:none windowtext 1.0pt;padding:0in">SubjectPublicKeyHash</span></a> is the hash output.</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">2. The CA MUST verify the Applicant’s control over the .onion Domain Name using one of the following:</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">a. The CA MAY verify the Applicant’s control over the .onion service by posting a specific value at a well-known URL under
RFC5785.</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">b. The CA MAY verify the Applicant’s control over the .onion service by having the Applicant provide a Certificate Request
signed using the .onion public key if the Attributes section of the certificationRequestInfo contains:</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">(i) A caSigningNonce attribute that 1) contains a single value with at least 64-bits of entropy, 2) is generated by the
CA, and 3) delivered to the Applicant through a Verified Method of Communication and (ii) An applicantSigningNonce attribute that 1) contains a single value with at least 64-bits of entropy and 2) is generated by the Applicant.</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">The signing nonce attributes have the following format:</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">caSigningNonce ATTRIBUTE ::= {</span><o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="margin-left:6.0pt;border-collapse:collapse">
<tbody>
<tr>
<td style="border:solid #ADB9CC 1.0pt;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">WITH SYNTAX</span><o:p></o:p></p>
</td>
<td style="border:solid #ADB9CC 1.0pt;border-left:none;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">OCTET STRING</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="border:solid #ADB9CC 1.0pt;border-top:none;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">EQUALITY MATCHING RULE</span><o:p></o:p></p>
</td>
<td style="border-top:none;border-left:none;border-bottom:solid #ADB9CC 1.0pt;border-right:solid #ADB9CC 1.0pt;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">octetStringMatch</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="border:solid #ADB9CC 1.0pt;border-top:none;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">SINGLE VALUE</span><o:p></o:p></p>
</td>
<td style="border-top:none;border-left:none;border-bottom:solid #ADB9CC 1.0pt;border-right:solid #ADB9CC 1.0pt;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">TRUE</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="border:solid #ADB9CC 1.0pt;border-top:none;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">ID</span><o:p></o:p></p>
</td>
<td style="border-top:none;border-left:none;border-bottom:solid #ADB9CC 1.0pt;border-right:solid #ADB9CC 1.0pt;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">{ cabf-caSigningNonce }</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">}</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">cabf-caSigningNonce OBJECT IDENTIFIER ::= { cabf 41 }</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">applicantSigningNonce ATTRIBUTE ::= {</span><o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="margin-left:6.0pt;border-collapse:collapse">
<tbody>
<tr>
<td style="border:solid #ADB9CC 1.0pt;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">WITH SYNTAX</span><o:p></o:p></p>
</td>
<td style="border:solid #ADB9CC 1.0pt;border-left:none;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">OCTET STRING</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="border:solid #ADB9CC 1.0pt;border-top:none;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">EQUALITY MATCHING RULE</span><o:p></o:p></p>
</td>
<td style="border-top:none;border-left:none;border-bottom:solid #ADB9CC 1.0pt;border-right:solid #ADB9CC 1.0pt;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">octetStringMatch</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="border:solid #ADB9CC 1.0pt;border-top:none;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">SINGLE VALUE</span><o:p></o:p></p>
</td>
<td style="border-top:none;border-left:none;border-bottom:solid #ADB9CC 1.0pt;border-right:solid #ADB9CC 1.0pt;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">TRUE</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td style="border:solid #ADB9CC 1.0pt;border-top:none;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">ID</span><o:p></o:p></p>
</td>
<td style="border-top:none;border-left:none;border-bottom:solid #ADB9CC 1.0pt;border-right:solid #ADB9CC 1.0pt;padding:3.0pt 6.0pt 3.0pt 6.0pt">
<p style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">{ cabf-applicantSigningNonce }</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">}</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">cabf-applicantSigningNonce OBJECT IDENTIFIER ::= { cabf 42 }</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">4. Each Certificate that includes a Domain Name where .onion is in the right-most label of the Domain Name MUST conform
to the requirements of these Guidelines, including the content requirements in Section 9 and Appendix B of the Baseline Requirements, except that the CA MAY include a wildcard character in the Subject Alternative Name Extension and Subject Common Name Field
as the left-most character in the .onion Domain Name provided inclusion of the wildcard character complies with Section 11.1.3 of the Baseline Requirements.</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">5. CAs MUST NOT issue a Certificate that includes a Domain Name where .onion is in the right-most label of the Domain Name
with a validity period longer than 15 months. Despite Section 9.2.1 of the Baseline Requirements deprecating the use of Internal Names, a CA MAY issue a Certificate containing an .onion name with an expiration date later than 1 November 2015 after (and only
if) .onion is officially recognized by the IESG as a reserved TLD.</span><o:p></o:p></p>
<p style="background:white;text-align:start;word-spacing:0px"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black">6. On or before May 1, 2015, each CA MUST revoke all Certificates issued with the Subject Alternative Name extension or
Common Name field that includes a Domain Name where .onion is in the right-most label of the Domain Name unless the Certificate was issued in compliance with this Appendix F.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<o:p></o:p></p>
</div>
</div>
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td style="background:white;padding:.75pt .75pt .75pt .75pt">
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt">
<pre>TREND MICRO EMAIL NOTICE<o:p></o:p></pre>
<pre>The information contained in this email and any attachments is confidential <o:p></o:p></pre>
<pre>and may be subject to copyright or other intellectual property protection. <o:p></o:p></pre>
<pre>If you are not the intended recipient, you are not authorized to use or <o:p></o:p></pre>
<pre>disclose this information, and we request that you notify us by reply mail or<o:p></o:p></pre>
<pre>telephone and delete the original message from your mail system.<o:p></o:p></pre>
</td>
</tr>
</tbody>
</table>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>