<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta name=Generator content="Microsoft Word 14 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML con formato previo Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Texto de globo Car";
margin:0cm;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";
color:black;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";
color:black;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
span.EstiloCorreo19
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EstiloCorreo20
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EstiloCorreo21
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.HTMLconformatoprevioCar
{mso-style-name:"HTML con formato previo Car";
mso-style-priority:99;
mso-style-link:"HTML con formato previo";
font-family:Consolas;
color:black;}
span.EstiloCorreo24
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.TextodegloboCar
{mso-style-name:"Texto de globo Car";
mso-style-priority:99;
mso-style-link:"Texto de globo";
font-family:"Tahoma","sans-serif";
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=ES link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>+1<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='line-height:9.75pt'><b><span lang=ES-TRAD style='font-size:8.5pt;font-family:"Tahoma","sans-serif"'>Iñigo Barreira</span></b><span lang=ES-TRAD style='font-size:8.5pt;font-family:"Tahoma","sans-serif"'><br>Responsable del Área técnica<br><a href="mailto:i-barreira@izenpe.eus"><span style='color:blue'>i-barreira@izenpe.eus</span></a> <o:p></o:p></span></p><p class=MsoNormal><span lang=ES-TRAD style='font-size:8.5pt;font-family:"Tahoma","sans-serif"'>945067705</span><span lang=ES-TRAD style='color:#1F497D'><o:p></o:p></span></p><p class=MsoNormal><span lang=ES-TRAD style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:navy'><img border=0 width=589 height=99 id="Imagen_x0020_1" src="cid:image001.jpg@01D1917A.74408C80" alt="Descripción: firma_email_Izenpe_eus"><o:p></o:p></span></p><p class=MsoNormal><span lang=ES-TRAD style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal style='line-height:9.75pt'><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif";color:#888888;mso-fareast-language:ES-TRAD'>ERNE! Baliteke mezu honen zatiren bat edo mezu osoa legez babestuta egotea. Mezua badu bere hartzailea. Okerreko helbidera heldu bada (helbidea gaizki idatzi, transmisioak huts egin) eman abisu igorleari, korreo honi erantzuna. KONTUZ!</span><span style='color:#888888;mso-fareast-language:ES-TRAD'><br></span><span style='font-size:7.5pt;font-family:"Tahoma","sans-serif";color:#888888;mso-fareast-language:ES-TRAD'>ATENCION! Este mensaje contiene informacion privilegiada o confidencial a la que solo tiene derecho a acceder el destinatario. Si usted lo recibe por error le agradeceriamos que no hiciera uso de la informacion y que se pusiese en contacto con el remitente.</span><span style='font-size:12.0pt;color:navy;mso-fareast-language:ES-TRAD'><o:p></o:p></span></p></div><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'>De:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext'> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>En nombre de </b>Rich Smith<br><b>Enviado el:</b> miércoles, 30 de marzo de 2016 18:32<br><b>Para:</b> public@cabforum.org<br><b>Asunto:</b> Re: [cabfpub] Certificate validity periods<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'>Jeremy,<br>I'm not sure Comodo would support any change at this point, but if we were to change I'd like to propose, let's call it 1c;<br>Set all max validity to 27 months; Require re-validation for all at 27 months.<br><br>I'm against your proposal of 1a for the same reasons I don't like 27/13 for EV It puts us in position of having to redo validation of a replacement request by the customer. In this case, the customer would get the DV or OV for 27 months, be able to replace at will, renew the cert for an additional 27 months, but be subject to revalidatiion half way through the 2nd when trying to get a replacement/re-issuance. This is bad enough with EV already, and I'm very much against extending it to OV/DV. If we can't find a reasonable path to match up the re-validation requirement with max validity then I'm against making any changes.<br><br>From the customer perspective, they expect to have to jump through hoops at the point of placing a new order. We don't generally get push back on that. What they don't expect, and what it is very difficult to make them understand is having to jump through the hoops again during the validity period of the same order. The customer doesn't understand these requirements and it causes a bad customer experience, for which they blame the CA.<br><br>-Rich<o:p></o:p></p><div><p class=MsoNormal>On 3/30/2016 11:04 AM, Jeremy Rowley wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal>Hi everyone, <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>I’d like to resurface the certificate validity period discussion and see if there is a way to move this forward. I’m still keen on seeing a standardized maximum validity period for all certificate types, regardless of whether the certificate is DV, OV, or EV. I believe the last time this was discussed, we reached an impasse where the browsers favored a shorter validity period for OV/DV and the CAs were generally supportive of a longer-lived EV certificate (39 months). The argument for a shorter validity period were 1) encourages key replacement, 2) ensures validation occurs more frequently, 3) deters damage caused by key loss or a change in domain control, and 4) permits more rapid changes in industry standards and accelerates the phase-out of insecure practices. The argument for longer validity periods: 1) customers prefer longer certificate validity periods, and 2) the difficulty in frequent re-validation of information. <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>So far, there seems to be two change proposals with a couple of variations:<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoListParagraph style='text-indent:-18.0pt'>1)<span style='font-size:7.0pt;font-family:"Times New Roman","serif"'> </span>Set all certificate validity periods to no more than 27 months<o:p></o:p></p><p class=MsoListParagraph style='margin-left:72.0pt;text-indent:-18.0pt'>a.<span style='font-size:7.0pt;font-family:"Times New Roman","serif"'> </span>Require re-validation of information for OV/DV certificates at 39 months OR<o:p></o:p></p><p class=MsoListParagraph style='margin-left:72.0pt;text-indent:-18.0pt'>b.<span style='font-size:7.0pt;font-family:"Times New Roman","serif"'> </span>Require re-validation of information for all certs at 13 months<o:p></o:p></p><p class=MsoListParagraph style='text-indent:-18.0pt'>2)<span style='font-size:7.0pt;font-family:"Times New Roman","serif"'> </span>Set all certificate validity periods to 39 months<o:p></o:p></p><p class=MsoListParagraph style='margin-left:72.0pt;text-indent:-18.0pt'>a.<span style='font-size:7.0pt;font-family:"Times New Roman","serif"'> </span>Require re-validation every 13 months<o:p></o:p></p><p class=MsoListParagraph style='margin-left:72.0pt;text-indent:-18.0pt'>b.<span style='font-size:7.0pt;font-family:"Times New Roman","serif"'> </span>Require re-validation of information for OV/DV certificates at 39 months<o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>What are the objections to 1a? With all the automated installers abounding, 1a seems to capture the simplicity and customer convenience of 39 months with the advantages of shorter-lived certs. Who would oppose/endorse a ballot that does one of these? <o:p></o:p></p><p class=MsoNormal> <o:p></o:p></p><p class=MsoNormal>Jeremy<o:p></o:p></p><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><br><br><br><o:p></o:p></span></p><pre>_______________________________________________<o:p></o:p></pre><pre>Public mailing list<o:p></o:p></pre><pre><a href="mailto:Public@cabforum.org">Public@cabforum.org</a><o:p></o:p></pre><pre><a href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></pre></blockquote><p class=MsoNormal><span style='font-size:12.0pt;font-family:"Times New Roman","serif"'><o:p> </o:p></span></p></div></body></html>