<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body dir="auto"><div><p class="MsoNormal"><font face="UICTFontTextStyleBody"><span style="font-size: 21px; background-color: rgba(255, 255, 255, 0);">Ryan,<o:p></o:p></span></font></p><p class="MsoNormal"><font face="UICTFontTextStyleBody"><span style="font-size: 21px; background-color: rgba(255, 255, 255, 0);"> </span></font></p><p class="MsoNormal"><font face="UICTFontTextStyleBody"><span style="font-size: 21px; background-color: rgba(255, 255, 255, 0);">Yes, that’s what I mean by private (not subject to the BRs).<o:p></o:p></span></font></p><p class="MsoNormal"><font face="UICTFontTextStyleBody"><span style="font-size: 21px; background-color: rgba(255, 255, 255, 0);"> </span></font></p><p class="MsoNormal"><font face="UICTFontTextStyleBody"><span style="font-size: 21px; background-color: rgba(255, 255, 255, 0);">The concerns I raised still apply... today it is common practice for customers to use certificates from roots trusted by browsers for private and/or non-browser use cases. The ballot needs an implementation date in the future to allow us and other CAs time to implement options for customers that distinguish these private/non-browser certificates, to make sure customers are aware of how these new rules relate to the future disclosure of publicly-accessible certificates, and to allow customers to replace their existing certificates where needed. This is why we proposed the interim disclosure approach, where prior to that implementation date, disclosure would still happen, but with the subject details redacted.</span></font></p><br>-Rick</div><div><br><b style="font-size: 12pt; font-family: 'Times New Roman', serif;"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size: 10pt; font-family: Tahoma, sans-serif;"> <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Ryan Sleevi</span></div><blockquote type="cite"><div class="WordSection1"><p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""><b>Sent:</b> Monday, December 07, 2015 3:49 PM<br><b>To:</b> Rick Andrews<br><b>Cc:</b> <a href="mailto:public@cabforum.org">public@cabforum.org</a><br><b>Subject:</b> Re: [cabfpub] Misissuance of certificates<o:p></o:p></span></p><p class="MsoNormal"><o:p> </o:p></p><div><p class="MsoNormal"><o:p> </o:p></p><div><p class="MsoNormal"><o:p> </o:p></p><div><p class="MsoNormal">On Mon, Dec 7, 2015 at 3:38 PM, Rick Andrews <<a href="mailto:Rick_Andrews@symantec.com" target="_blank">Rick_Andrews@symantec.com</a>> wrote:<o:p></o:p></p><p class="MsoNormal">Sigbjørn,<br><br>While we agree with this proposal, it wouldn't address our key use case.<br><br>We've talked to very large customers about technically-constrained intermediates, and this is consistently not doable because their list of owned domains changes so frequently. After further consideration, issuing internal-only or non-browser certs from a private root is the most straightforward and comprehensive approach.<o:p></o:p></p><div><p class="MsoNormal"><o:p> </o:p></p></div><p class="MsoNormal">Rick,<o:p></o:p></p><div><p class="MsoNormal"><o:p> </o:p></p></div><div><p class="MsoNormal">When you say "private root", you mean a root that is exempted from the Baseline Requirements (presumably, because it is not a publicly trusted root), correct?<o:p></o:p></p></div><div><p class="MsoNormal"><o:p> </o:p></p></div><div><p class="MsoNormal">If that's a correct understanding, would it be fair to interpret your response as meaning that you withdraw your concerns, because they would not affect you? Or are there still concerns you feel with this proposal that, even under the scenario you described, would require modification to the proposed language?<o:p></o:p></p></div></div></div></div></div></blockquote><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style></body></html>