<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Bonjour,
<div class=""><br class="">
</div>
<div class="">See my answers inline.</div>
<div class=""><br class="">
<div class="">
<div class="">Cordialement,</div>
<div class="">Erwann Abalea</div>
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">Le 20 juil. 2016 à 11:48, 陳立群 <<a href="mailto:realsky@cht.com.tw" class="">realsky@cht.com.tw</a>> a écrit :</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(0, 112, 192);" class=""> I reply as below, for readers easily to see what Erwann wrote were (<a href="https://cabforum.org/pipermail/public/2016-July/007996.html" style="color: purple; text-decoration: underline;" class="">https://cabforum.org/pipermail/public/2016-July/007996.html</a>)
, what I reply now are, I suggest to read attached pdf file, what I reply are in red or blue color.<o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">Bonsoir,</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">About small countries that haven</span><span style="" class="">’</span><span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">t set up any state or province.</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">X.520 definition for the stateOrProvinceName attribute is (from 201210 edition):</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">The State or Province Name attribute type specifies a state or province. When used as a component of a directory name, it identifies a geographical subdivision in which the named object
is physically located or with which it is associated in some other important way.</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">«Geographical subdivision » can mean anything. Maybe some would disagree, but I think that a CA can stretch it pretty easily while respecting the BRs.</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">If you want to follow the intent of the « province », since this latin-based word designates an administrative subdivision, it can even be a city or a village, and doesn</span><span style="" class="">’</span><span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">t
necessarily mean a State in the US way. All the countries listed in Note 2 have cities.</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif; color: red;" class="">=====><b class=""><span class="Apple-converted-space"> </span>I think X.520 clearly specifies that 'The State or Province Name attribute type specifies a state or province.'
(This is the first sentence of the stateOrProvinceName</b></span><b class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif;" class=""> </span></b><b class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: red;" class="">definition
in X.520.) Should CAB Forum encourage the ambiguity that CAs may put the name of administrative subdivision at any level (such as a city, a county, a town, or a village) into stateOrProvinceName</span></b><b class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif;" class=""> </span></b><b class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: red;" class="">attribute?
No, I don't think so.</span></b><span style="font-size: 12pt;" class=""> </span></div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>But X.520 doesn’t define what a state or a province is or isn’t. Nor does X.520 define what is or isn’t a valid country, or what is or isn’t a valid organization.</div>
<div><br class="">
</div>
<div>X.520 defines a set of attributes, organizes them into types (labelling, geographical, organizational, etc), and gives some guidance on the intent of these attributes.</div>
<div><br class="">
</div>
<div>Looking at different sources to get the definition of « province », they all agree on the fact that a province is at least an administrative division of a country. The Oxford Dictionary of English defines province as « a principal administrative division
of a country or empire » (here, principal is still subjective). A county, town, city, or even a village is an administrative division. In small countries, city may be the highest level of administrative division.</div>
<div><br class="">
</div>
<div>X.520 hasn’t defined an attribute intended to hold a brand name (DBA), and the CABForum has decided that the organizationName attribute can hold either the legal name (complete or with abbreviations) or the brand name, and even a natural person’s name
(for IV certs).</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">About the uniqueness of an organizationName at a country level.</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">OV/IV certificates are not meant to unambiguously identify the subject named in the certificate. That role is left for EV certificates.</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif; color: rgb(31, 73, 125);" class="">====><span class="Apple-converted-space"> </span></span><b class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: red;" class="">I
am really surprised to see the interpretation that 'OV/IV certificates are not meant to unambiguously identify the subject named in the certificate' in the CAB Forum. Is this a common cognition of the CAB Forum? The fundamental function of a public-key certificate
is to assert the binding between the subject identity and its public key, isn't it?</span></b></div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Yes. Assert a binding between a public key and an identity, and verify that the applicant has the right to claim this identity. Not assert that this identity is not shared with someone else. Not assert that the bound name is the only possible representation
of the entity’s name.</div>
<div>If you need these guarantees, then you need to define a set of name canonicalization rules.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<b class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: red;" class="">The value of a CA in the internet community is to act as a Trusted Third Party (TTP) which is responsible to verify the identity of the subject and then guarantee
the binding between the subject identity and its public key.</span></b></div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Again, that’s right. The CA verifies the claimed identity, and binds it with the public key. Nothing more for DV/OV/IV.</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<b class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: red;" class="">I think that OV/IV certificates still need to unambiguously identify the subject named in the certificate. The difference between OV/IV certificates and EV certificates
is that they provide different level of assurance regarding the identity information verified. I understand that there does not exist a global X.500 directory. However, A CA should still make its best to unambiguously identify the subject named in the OV/IV
certificate. At least, the CA should guarantee that two different entities never share the same subject DN, otherwise how the relying parties can distinguish which organization/individual is actually behind the OV/IV certificate?</span></b></div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>This is the purpose of EV. Attributes have been defined to hold the incorporation/registration informations, the business category is included in the name, and a non ambiguous naming scheme has been defined.</div>
<br class="">
<blockquote type="cite" class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<b class=""><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></b></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" class="" style="font-size: 12pt; font-family: 'Times New Roman', serif; color: blue;">I have replied in previous email to Peter in </span><span lang="EN-US" class="" style="font-size: 12pt;"><a href="https://cabforum.org/pipermail/public/2016-June/007897.html" target="_blank" style="color: purple;" class=""><span style="font-family: 'Times New Roman', serif;" class="">https://cabforum.org/pipermail/public/2016-June/007897.html</span></a></span><span lang="EN-US" class="" style="font-size: 12pt; font-family: 'Times New Roman', serif; color: blue;"> as
below</span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif; text-indent: 12pt;" class="">
<i class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">For IV SSL certificate or citizen certificates, we can add unique serial number in Subject Distinguished Names to two different entities have the same names.
(You said EV SSL certificates solve the problem, but don</span></i><i class=""><span style="color: blue;" class="">’</span></i><i class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">t forget that EV SSL Certificates
will not be issued to individuals, only be issued to Private Organization, Government Entities, Business entities and non-profit international organizations</span></i><span style="font-size: 12pt;" class=""> </span></div>
</div>
</blockquote>
<div><br class="">
</div>
<div>Let’s suppose it's something we want to do for DV/OV/IV.</div>
<div>We can add such a unique serialNumber attribute. This serialNumber needs to be shared among all CAs, either by constituting a common database, or by combining some sort of identification document type (ID card, passport, whatever) and the number. If we
don’t have this globally unique number, then CA1 could assign serialNumber 1 for user A, CA2 could assign serialNumber 1 to user B, user A and user B could be homonyms, and the desired goal isn’t achieved (relying party is unable to distinguish the identities).</div>
<div>Is that something we want for natural persons, worldwide?</div>
<br class="">
<blockquote type="cite" class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif; text-indent: 18pt;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">Note that in<span class="Apple-converted-space"> </span></span><span lang="EN-US" class=""><a href="https://cabforum.org/pipermail/public/2016-July/007912.html" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="font-family: 'Times New Roman', serif;" class="">https://cabforum.org/pipermail/public/2016-July/007912.html</span></a></span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">,
I have replied to Peter in RFC 3739 there are Qualified Certificates Profiles.</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 細明體;" class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">I suggest you to read </span></pre>
</div>
</blockquote>
<div><br class="">
</div>
<div>I know about Qualified Certificates. CABF OV/IV are not Qualified Certificates. Even EV are not Qualified Certificates. I don’t want to impose Qualified Certificates to every CA.</div>
<br class="">
<blockquote type="cite" class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 細明體;" class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">3.1.2. Subject</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 細明體;" class=""><span lang="EN-US" style="" class=""> </span></pre>
<pre style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 細明體;" class=""><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">The serialNumber attribute type SHALL, when present, be used to differentiate between names where the subject field would otherwise be identical. This attribute has no defined semantics beyond ensuring uniqueness of subject names. It MAY contain a number or code assigned by the CA or an identifier assigned by a government or civil authority. It is the CA's responsibility to ensure that the serialNumber is sufficient to resolve any subject name collisions.</span><span style="font-family: 新細明體, serif; font-size: 12pt;" class=""> </span></pre>
</div>
</blockquote>
<div><br class="">
</div>
<div>Now, the relying party will be able to distinguish identity A and identity B even when names are shared (homonyms, company name, brands), but within a given CA only. In a sense, what will be unique is the combination issuerName+subjectName, not subjectName
alone.</div>
<br class="">
<blockquote type="cite" class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif; text-indent: 12pt;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">So for Taiwan</span><span style="color: blue;" class="">’</span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">s GPKI, we can resolve
any subject name collisions for government entities</span><span style="color: blue;" class="">’</span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class=""><span class="Apple-converted-space"> </span>SSL certificates or citizen
certificates more than 13 years.</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
</div>
</div>
</blockquote>
<div><br class="">
</div>
<br class="">
<blockquote type="cite" class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" class="" style="font-size: 12pt; font-family: 'Times New Roman', serif;">For example, in an IV certificate, there can be more than one individuals named John Malkovich, living in the same country, same province, same city. Only one of them
will obviously be able to have the</span><span lang="EN-US" class="" style="font-size: 12pt;"><a href="http://johnmalkoti.ch/" target="_blank" style="color: purple;" class=""><span style="font-family: 'Times New Roman', serif;" class="">johnmalkoti.ch</span></a></span><span lang="EN-US" class="" style="font-size: 12pt; font-family: 'Times New Roman', serif;"> domain,
if it exists (it doesn</span><span class="" style="font-size: 12pt;">’</span><span lang="EN-US" class="" style="font-size: 12pt; font-family: 'Times New Roman', serif;">t).</span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">Talking about OV certificates, even if it</span><span style="" class="">’</span><span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">s not possible to have 2 companies
with the same name in the same jurisdiction, it</span><span style="" class="">’</span><span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">s possible to have 2 certificates having the same name representing 2 different entities. For example
«C=UT, ST=MyVillage, O=XXXX», if XXXX is both a company and a brand (DBA).</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">Combine OV and IV, and «C=UT, ST=MyVillage, O=XXXX» can represent 3 different things, if XXXX is also the full name of an individual and the CA chooses to place this full name in the
O field instead of GN/SN. (for a country named Utopia)</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">The rule for an OV/IV is something like « if you can provide evidence of the claimed identity, it</span><span style="" class="">’</span><span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">s
good».</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">Again, if you want to disambiguate claimed identities, you</span><span style="" class="">’</span><span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">re free to
add other attributes, or provide an EV certificate.</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">I don</span><span style="" class="">’</span><span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">t support the proposed BR changes, they only add complexity without
any real benefit.</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">Looking at the example certificates:</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<ul type="disc" style="margin-bottom: 0cm; margin-top: 0cm;" class="">
<li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">certificate 1 is not problematic; if you want a less cluttered certificate, go for a DV; wether VA is really a country or not is left as an exercise (it</span>’<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">s
a territory for me, but I</span>’<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">m not so difficult)</span><span lang="EN-US" class=""><o:p class=""></o:p></span></li></ul>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">===>VA is really a country, they don</span><span style="color: blue;" class="">’</span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">t
set up a government entity whose legal name is called Vatican City<span class="Apple-converted-space"> </span></span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: red;" class="">State</span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class=""><span class="Apple-converted-space"> </span>or
Vatican City<span class="Apple-converted-space"> </span></span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: red;" class="">Province</span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">, but </span><span lang="EN-US" class=""><a href="https://crt.sh/?q=98+ef+2b+4c+43+39+ae+04+3b+bd+55+08+59+b2+b7+b4+ee+76+cb+af" target="_blank" style="color: purple; text-decoration: underline;" class=""><span style="font-family: 'Times New Roman', serif;" class="">https://crt.sh/?q=98+ef+2b+4c+43+39+ae+04+3b+bd+55+08+59+b2+b7+b4+ee+76+cb+af</span></a><span style="" class=""><o:p class=""></o:p></span></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>A country without a government?</div>
<div>The government is the Holy See, maintains diplomatic relations with other states, has an observer status at UN (non-member), and its sovereign territory is the Vatican.</div>
<div>The Vatican is only a territory.</div>
<div>I’m sure attorneys and jurists following the list may find interest reading about the situation of Holy See and Vatican.</div>
<br class="">
<blockquote type="cite" class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-size: 10pt; font-family: 'Times New Roman', serif; color: blue;" class="">The Subject DN is<br class="">
commonName=*.catholica.va<br class="">
organizationName=Department of Telecommunications<br class="">
localityName=Vatican City<br class="">
stateOrProvinceName=Vatican City<span class="Apple-converted-space"> </span></span><span lang="EN-US" style="font-size: 10pt; font-family: 'Times New Roman', serif; color: red;" class="">State</span><span lang="EN-US" style="font-size: 10pt; font-family: 'Times New Roman', serif; color: blue;" class=""><br class="">
countryName =VA</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-size: 10pt; font-family: 'Times New Roman', serif; color: blue;" class="">The subject DN should be</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-size: 10pt; font-family: 'Times New Roman', serif; color: blue;" class="">commonName=*.catholica.va<br class="">
organizationName=Department of Telecommunications<br class="">
countryName =VA</span><span lang="EN-US" style="" class=""><o:p class=""></o:p></span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="" class=""> </span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-size: 10pt; font-family: 'Times New Roman', serif; color: blue;" class="">It is enough to identify the domain name owner in Vatican.</span></div>
</div>
</blockquote>
<div><br class="">
</div>
<div>What is your goal? Asserting the smallest unambiguous possible name, or assert a correct name? OV/EV/IV goal is the second.</div>
<br class="">
<blockquote type="cite" class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span style="font-size: 12pt;" class=""> </span></div>
<ul type="disc" style="margin-bottom: 0cm; margin-top: 0cm;" class="">
<li class="MsoNormal" style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;">
<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">certificate 2 is not wrong per se; Taichung City being a geographical subdivision of Taiwan, an administrative division, and a city, it</span>’<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">s
not wrong to have Taichung in both the ST and L attributes<span class="Apple-converted-space"> </span></span>—<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class=""><span class="Apple-converted-space"> </span>second example is « ST=Taiwan,
L=Kaohsiung»; Taiwan being a province of the Taiwan country, and Kaohsiung being a city, it</span>’<span lang="EN-US" style="font-family: 'Times New Roman', serif;" class="">s not wrong</span><span lang="EN-US" class=""><o:p class=""></o:p></span></li></ul>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">===>Taichung City and Kaohsiung City are 6 special municipalities (Traditional<span class="Apple-converted-space"> </span></span><span lang="EN-US" class=""><a href="https://en.wikipedia.org/wiki/Traditional_Chinese_characters" target="_blank" title="Traditional Chinese characters" style="color: purple; text-decoration: underline;" class=""><span style="font-family: 'Times New Roman', serif; text-decoration: none;" class="">Chinese</span></a></span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">:<span class="Apple-converted-space"> </span></span><span style="color: blue;" class="">直轄市</span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">)
or called<span class="Apple-converted-space"> </span></span><span lang="EN-US" class=""><a href="https://en.wikipedia.org/wiki/Executive_Yuan" target="_blank" title="Executive Yuan" style="color: purple; text-decoration: underline;" class=""><span style="font-family: 'Times New Roman', serif; text-decoration: none;" class="">Yuan</span></a></span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">-controlled
municipalities (</span><span style="color: blue;" class="">院轄市</span><span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">),theYuan is referred to the Executive Yuan. Special municipalities have the rank of province.
</span></div>
</div>
</blockquote>
<br class="">
<blockquote type="cite" class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">[…]</span></div>
</div>
</blockquote>
<blockquote type="cite" class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif;" class="">
<span style="color: blue; font-family: 'Times New Roman', serif; font-size: 12pt; line-height: 18.9pt;" class="">isions of this Act, or to matters that are to be handled by such bodies in accordance with law and where such bodies are responsible for policy
formulation and implementation.</span></div>
<div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 新細明體, serif; text-indent: 18pt;" class="">
<span lang="EN-US" style="font-family: 'Times New Roman', serif; color: blue;" class="">For government entity's DN and OID, our government set up a site at<span class="Apple-converted-space"> </span><a href="http://oid.nat.gov.tw/" style="color: purple; text-decoration: underline;" class="">oid.nat.gov.tw</a>,
it is UTF 8 code in Traditional Chinese. It is no need to put S=Taiwan in DN for entities under Taichung City and Kaohsiung City.</span></div>
</div>
</blockquote>
<div><br class="">
</div>
<div>And this government failed to follow normalized practice.</div>
<div>The OID arc 2.16 is governed by rules listed in X.660, and those rules were not followed. 2.16.886 is NOT an OID that the government of Taiwan can use.</div>
<div>Yet you want to write rules that cover the 200+ countries and their particularities, and ask all CAs to follow them…</div>
<br class="">
</div>
<br class="">
</div>
</body>
</html>