<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">What would you think about defining a new term, “Compliance Date”?</div><div class=""><br class=""></div><div class=""><div class="">Compliance Date: The Compliance Date of a certificate is the earlier of the notBefore field or when the CA signs the certificate</div></div><div class=""><br class=""></div><div class="">Then it can be used to make it very clear:</div><div class=""><br class=""></div><div class=""><div class="WordSection1" style="page: WordSection1;"><div class="" style="margin: 0in 0in 0.0001pt;">These Requirements <u class="">apply to all Certificates with a Compliance Date of or after February 15, 2013 that include id_kp_serverAuth (1.3.6.1.5.5.7.3.1) in the extended key usage extension. Additionally, these Requirements apply to all Certificates </u><u class="">with a Compliance Date of or after June 30, 2016 </u><u class="">that either do not include the extended key usage extension or include anyExtendedKeyUsage (2.5.29.37.0) in the extended key usage extension.</u></div><div class="" style="margin: 0in 0in 0.0001pt;"><u class=""><br class=""></u></div><div class="" style="margin: 0in 0in 0.0001pt;">I might also suggest replacing the sentence "The requirements are not mandatory for Certification
Authorities unless and until they become adopted and enforced by relying–party Application Software
Suppliers.” with “These Requirements became mandatory for Certification Authorities on February 15, 2013.” </div><div class="" style="margin: 0in 0in 0.0001pt;"><br class=""></div><div class="" style="widows: 1; margin: 0in 0in 0.0001pt;">The Feb 2013 date is based on the email thread in Feb 2015 titled "<span style="color: rgb(34, 34, 34); widows: 1; background-color: rgb(255, 255, 255);" class="">When did the WebTrust/ETSI </span><span class="il" style="color: rgb(34, 34, 34); widows: 1; background-color: rgb(255, 255, 255);">BR</span><span style="color: rgb(34, 34, 34); widows: 1; background-color: rgb(255, 255, 255);" class=""> audit requirement become mandatory?</span><font color="#222222" class="">”</font></div><div class="" style="margin: 0in 0in 0.0001pt;"><span style="color: rgb(34, 34, 34); widows: 1; background-color: rgb(255, 255, 255);" class=""><br class=""></span></div><div class="" style="margin: 0in 0in 0.0001pt;"><span style="color: rgb(34, 34, 34); widows: 1; background-color: rgb(255, 255, 255);" class="">Thanks,</span></div><div class="" style="margin: 0in 0in 0.0001pt;"><span style="color: rgb(34, 34, 34); widows: 1; background-color: rgb(255, 255, 255);" class="">Peter</span></div></div></div><div class=""><br class=""></div><div class=""><br class=""></div><div><blockquote type="cite" class=""><div class="">On Jan 20, 2016, at 11:37 AM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" class="">jeremy.rowley@digicert.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">To move this discussion forward (and resurrect my old proposal), I’d like to have a ballot that defines the scope of the BRs as follows:<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><span class="">1)<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Effectively immediately, any certificate chaining to a publicly trusted root containing the serverAuth EKU is considered in scope<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><span class="">2)<span style="font-style: normal; font-variant: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Effective Jun 30, 2016, any certificate containing either no EKU or any EKU is in scope.<span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">The language change would be to Section 1.1:<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">These Requirements<span class="Apple-converted-space"> </span><u class="">apply to all Certificates that include id_kp_serverAuth (1.3.6.1.5.5.7.3.1) in the extended key usage extension. Effective June 30, 2016, these Requirements apply to all Certificates that either omit the extended key usage extension or include either id_kp_serverAuth (1.3.6.1.5.5.7.3.1) or anyExtendedKeyUsage (2.5.29.37.0) in the extended key usage extension.<span class="Apple-converted-space"> </span><s class="">containing an extended</s></u><s class="">only address Certificates intended to be used for authenticating servers accessible through the Internet</s>.<span class="Apple-converted-space"> </span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a name="_MailEndCompose" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></a></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Thoughts?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Ryan Sleevi [<a href="mailto:sleevi@google.com" style="color: purple; text-decoration: underline;" class="">mailto:sleevi@google.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Monday, January 18, 2016 1:00 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Jeremy Rowley<br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Rick Andrews; Peter Bowen; Doug Beattie;<span class="Apple-converted-space"> </span><a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline;" class="">public@cabforum.org</a><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [cabfpub] Misissuance of certificates<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Mon, Jan 18, 2016 at 11:53 AM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank" style="color: purple; text-decoration: underline;" class="">jeremy.rowley@digicert.com</a>> wrote:<o:p class=""></o:p></div><blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I don’t recall that as being the case. I think the discussion stalled because certain national programs used the anyEKU and their national policies conflicted with the BRs. I know we all agreed serverAuth ought to be included. The question was on no EKU and anyEKU as they are both technically server certs. </span><o:p class=""></o:p></div></div></blockquote><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Isn't that what I said? ;)<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">no EKU and anyEKU are both accepted by all browsers as being valid for issuance.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">There were some CAs who, as you note, in collaboration with certain national PKI projects, had issued a number of such intermediate certificates, but wished to exclude them from BR compliance.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">And that's where and how we stalled - CAs that were capable of issuing certificates trusted for TLS authentication wished to be out of scope of issuance.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">There was the suggestion of who should bear that cost - either the CAs doing this, which would need to either stop participating in such programs or reissue intermediates, or browsers, with the proposal being that all new software only accept serverAuth EKUs. There was, unsurprisingly, also objections about whether the EKUs should chain - that is, in RFC 5280, they apply to the leaf certificate, but as implemented by many libraries, the intermediate's EKU set is expected to be a superset of the leaf EKU set.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">This discussion reached an impasse because neither party was really willing to budge. In response, both Mozilla and Microsoft implemented root program requirements that made this clear, with Mozilla's policy language being very explicit that anything that can technically cause issuance needs to be in scope of a BR audit, or be technically restricted from such issuance.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">So now we're having this conversation again, but with clearer policies as to what browsers expect. Does that make this national policies go away? No. But it sets out the expectation of what constitutes publicly trusted, and therefore what constitutes as scope of needing BR audits.</div></div></div></div></div></div></div></blockquote></div><br class=""></body></html>