<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:TimesNewRomanPS-BoldMT;}
@font-face
{font-family:TimesNewRomanPSMT;}
@font-face
{font-family:Cambria;
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Cambria-Bold;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:516308094;
mso-list-template-ids:-954162770;}
@list l1
{mso-list-id:1610627296;
mso-list-template-ids:1427162482;}
@list l1:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level2
{mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">To my mind, the provisions of BR Sec. 8 and 9.16.3, and EVGL Sec. 8.1, could be interpreted as allowing the laws and regulations of Spain concerning certificate
profiles and content to override the requirements of the BRs and EVGL. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Accordingly, there may be no need for Spanish CAs to do anything differently as to the earlier certs – they can assert to their auditors that Spanish law and
regulation is allowed to control on this issue, and so they are in full compliance because of BR Sec. 8 and 9.16.3, and EVGL Sec. 8.1. See below.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><b>BR 8. COMPLIANCE AUDIT AND OTHER ASSESSMENTS</b><b><span style="font-size:11.0pt"><o:p></o:p></span></b></p>
<p class="MsoNormal" style="text-autospace:none">The CA SHALL at all times:<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none">1. <u>Issue Certificates and operate its PKI in accordance with all law applicable to its business and the Certificates it issues in every jurisdiction in which it operates</u>;<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none">2. Comply with these Requirements;<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none">3. Comply with the audit requirements set forth in this section; and<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none">4. Be licensed as a CA in each jurisdiction where it operates, if licensing is required by the law of such jurisdiction for the issuance of Certificates.<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><b><o:p> </o:p></b></p>
<p class="MsoNormal" style="text-autospace:none"><b>BR 9.16.3. Severability<o:p></o:p></b></p>
<p class="MsoNormal">If a court or government body with jurisdiction over the activities covered by these Requirements determines that the performance of any mandatory requirement is illegal,
<u>then such requirement is considered reformed to the minimum extent necessary to make the requirement valid and legal</u>. This applies only to operations or certificate issuances that are subject to the laws of that jurisdiction. The parties involved SHALL
notify the CA / Browser Forum of the facts, circumstances, and law(s) involved, so that the CA/Browser Forum may revise these Requirements accordingly.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none"><b>EVGL 8. Community and Applicability<o:p></o:p></b></p>
<p class="MsoNormal" style="text-autospace:none"><b>8.1. Issuance of EV Certificates<o:p></o:p></b></p>
<p class="MsoNormal">The CA MAY issue EV Certificates, provided that the CA and its Root CA satisfy the requirements in these Guidelines and the Baseline Requirements. If a court or government body with jurisdiction over the activities covered by these Guidelines
determines that the performance of any mandatory requirement is illegal, <u>then such requirement is considered reformed to the minimum extent necessary to make the requirement valid and legal</u>. This applies only to operations or certificate issuances that
are subject to the laws of that jurisdiction. The parties involved SHALL notify the CA / Browser Forum of the facts, circumstances, and law(s) involved, so that the CA/Browser Forum may revise these Guidelines accordingly.<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>Dean Coclin<br>
<b>Sent:</b> Wednesday, July 6, 2016 1:56 PM<br>
<b>To:</b> Chema Lopez <clopez@firmaprofesional.com>; public@cabforum.org<br>
<b>Subject:</b> Re: [cabfpub] SAN private extensions pursuant specific SSL/EV Spanish ruled profile<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I recall there being some discussion on another list about this (perhaps Mozilla) and maybe others that follow that could comment.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">If you want to bring this up on the CABF call, please let me know. Unfortunately this week’s agenda is full but we could schedule it for 2 weeks from now.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><br>
Thanks<br>
Dean<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">
<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Chema Lopez<br>
<b>Sent:</b> Wednesday, June 29, 2016 1:34 PM<br>
<b>To:</b> <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
<b>Subject:</b> [cabfpub] SAN private extensions pursuant specific SSL/EV Spanish ruled profile<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Dear all.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There was a law in Spain that regulates the profile for some specific certificates, i.e.:<o:p></o:p></p>
</div>
<div>
<ol start="1" type="1">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo3">
Civil Servant or Public Employee (natural person certificate)<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo3">
Electronic Seal for Automated Administrative Action<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo3">
Electronic Office Certificate (SSL or EV for Public Administrations)<o:p></o:p></li></ol>
<div>
<p class="MsoNormal">You can find the profiles attached (unfortunately only in Spanish).<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The problem is that these profiles required private extensions in the SAN, and this conflicts BR and EV Guidelines. At least, crt.sh shows this extensions as an error. See the private extensions below.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><img border="0" width="544" height="183" id="_x0000_i1025" src="cid:image001.png@01D1DDC0.0B008DA0" alt="Inline images 1"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">This law has been repealed recently and the new one does not require this extensions but, how do we, Spanish TSP, handle the SSL and EV certificates issued following the previous law? In my opinion, an exception needs to be added.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks in advance for your comments.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Best regards,<o:p></o:p></p>
</div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<table class="MsoNormalTable" border="0" cellspacing="3" cellpadding="0">
<tbody>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt"></td>
<td style="padding:.75pt .75pt .75pt .75pt">
<p><b><span style="font-family:"Arial",sans-serif;color:#999999">Chema López González<br>
Director Área de Innovación, Cumplimiento y Tecnología<br>
AC Firmaprofesional S.A.</span></b><span style="font-family:"Arial",sans-serif;color:#999999"><o:p></o:p></span></p>
</td>
</tr>
<tr>
<td style="padding:.75pt .75pt .75pt .75pt"></td>
<td style="padding:.75pt .75pt .75pt .75pt">
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><br>
<span style="color:#999999">Av. Torre Blanca, 57.</span> <br>
<span style="color:#999999">Edificio ESADECREAPOLIS - 1B13</span><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#999999">08173 Sant Cugat del Vallès. Barcelona.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#999999">Tel: </span><span style="font-family:"Arial",sans-serif">93.477.42.45<span style="color:#999999"> /</span><span style="color:#3333FF"> 666.429.224</span><o:p></o:p></span></p>
</div>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">El contenido de este mensaje y de sus anexos es confidencial. Si no es el destinatario, le hacemos saber que está prohibido utilizarlo, divulgarlo y/o copiarlo sin tener la autorización correspondiente.
Si ha recibido este mensaje por error, le agradeceríamos que lo haga saber inmediatamente al remitente y que proceda a destruir el mensaje.<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>