<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jul 15, 2016 at 5:03 PM, Kirk Hall <span dir="ltr"><<a href="mailto:Kirk.Hall@entrust.com" target="_blank">Kirk.Hall@entrust.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Why do browsers need this kind of information to be disclosed to them? What difference does it make to a browser? Seems like the information is not directed
at the browsers.</span></p></div></div></blockquote><div><br></div><div>Could you re-read the message you're replying to and let me know what part confused you? I discussed a very real, very practical concern - one that we've discussed in person and on the list before.</div><div><br></div><div>Perhaps this is why it's important to keep good minutes, since we seem to keep rehashing things.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">In any case, the existing BR and EVGL rules don’t require disclosure, they just require compliance with local law, which is appropriate.</span></p></div></blockquote><div><br></div><div>Could you re-read the BRs and explain to me why you don't feel it requires disclosure? In particular, please read the statement beginning with "The parties involved SHALL notify the CA / Browser Forum". It would be useful to understand why you don't believe this represents an obligation for disclosure.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]
<br>
<b>Sent:</b> Friday, July 15, 2016 3:53 PM<br>
<b>To:</b> Kirk Hall <<a href="mailto:Kirk.Hall@entrust.com" target="_blank">Kirk.Hall@entrust.com</a>><br>
<b>Cc:</b> Dean Coclin <<a href="mailto:Dean_Coclin@symantec.com" target="_blank">Dean_Coclin@symantec.com</a>>; Chema Lopez <<a href="mailto:clopez@firmaprofesional.com" target="_blank">clopez@firmaprofesional.com</a>>; <a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a><span class=""><br>
<b>Subject:</b> Re: [cabfpub] SAN private extensions pursuant specific SSL/EV Spanish ruled profile<u></u><u></u></span></span></p>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
<div>
<p class="MsoNormal">On Thu, Jul 14, 2016 at 11:08 AM, Kirk Hall <<a href="mailto:Kirk.Hall@entrust.com" target="_blank">Kirk.Hall@entrust.com</a>> wrote:<u></u><u></u></p><div><div class="h5">
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">To my mind, the provisions of BR Sec. 8 and 9.16.3, and EVGL Sec. 8.1, could be interpreted as allowing the laws and regulations of Spain concerning certificate
profiles and content to override the requirements of the BRs and EVGL. </span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d"> </span><u></u><u></u></p>
<p><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1f497d">Accordingly, there may be no need for Spanish CAs to do anything differently as to the earlier certs – they can assert to their auditors that Spanish law
and regulation is allowed to control on this issue, and so they are in full compliance because of BR Sec. 8 and 9.16.3, and EVGL Sec. 8.1. See below.</span><u></u><u></u></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">However, as we discussed in person at the CA/B Forum meeting in Scottsdale, there is an obligation of CAs to disclose these regulations so that the Forum can be so informed.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">While Chema has now done this (and Inigo had previously), it can't be argued these are apriori conforming and in full compliance.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I'm struggling to find this in the minutes, but if you'll recall, Gerv and I discussed various interpretations of this. For example, if a US CA were presented with an order to ignore domain validation and, say, issue a certificate for
<a href="http://www.google.com" target="_blank">www.google.com</a>, would the CA be argued to be in full compliance with the BRs for doing so? We discussed questions about what it meant for the Forum to be notified - is this a public mailing list, a management list, etc. We
discussed the hypothetical concern about government-issued gag notices as well.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Unfortunately, none of this was minuted. However, thankfully Gerv sent a public mail shortly thereafter, which at least helps me make sure I'm not misremembering things (although I could totally be missing where it appears on the minutes
in <a href="https://cabforum.org/2016/02/17/2016-02-17-minutes-of-f2f-meeting-37/" target="_blank">
https://cabforum.org/2016/02/17/2016-02-17-minutes-of-f2f-meeting-37/</a> ) - but you can read the thread at <a href="https://cabforum.org/pipermail/public/2016-April/007465.html" target="_blank">https://cabforum.org/pipermail/public/2016-April/007465.html</a><u></u><u></u></p>
</div>
</div></div></div>
</div>
</div>
</div>
</div>
</blockquote></div><br></div></div>