<html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><style>body { line-height: 1.5; }blockquote { margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em; }body { font-size: 10pt; font-family: 微软雅黑; color: rgb(0, 0, 128); line-height: 1.5; }</style></head><body>
<div><span></span>CNNIC votes "yes".</div><div><br></div><div>Best Regards,</div><div>Vicky</div><hr style="width: 210px; height: 1px;" color="#b5c4df" size="1" align="left">
<div><span><div style="MARGIN: 10px; FONT-FAMILY: verdana; FONT-SIZE: 10pt"><div>cab@cnnic.cn</div></div></span></div><blockquote style="margin-top: 0px; margin-bottom: 0px; margin-left: 0.5em;"><div>
<div> </div>
<div>-----Original Message-----</div>
<div>From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Dean Coclin</div>
<div>Sent: Friday, July 22, 2016 6:28 PM</div>
<div>To: Josh Aas <josh@letsencrypt.org>; CABFPub <public@cabforum.org></div>
<div>Subject: Re: [cabfpub] Ballot 173 - Removal of requirement to cease use of private key due to incorrect certificate info</div>
<div> </div>
<div>Thanks Josh. So for clarification for others voting, the revised ballot includes the 45 day effective date. </div>
<div> </div>
<div>-----Original Message-----</div>
<div>From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Josh Aas</div>
<div>Sent: Friday, July 22, 2016 7:49 PM</div>
<div>To: CABFPub <public@cabforum.org></div>
<div>Subject: Re: [cabfpub] Ballot 173 - Removal of requirement to cease use of private key due to incorrect certificate info</div>
<div> </div>
<div>To clarify, my YES vote includes the 45-day waiting period before the changes take effect.</div>
<div> </div>
<div>All votes from this point on should be for the ballot as originally proposed but with a 45 day waiting period before the changes take effect. Thanks.</div>
<div> </div>
<div>On Fri, Jul 22, 2016 at 4:30 PM, Josh Aas <josh@letsencrypt.org> wrote:</div>
<div>> Let's Encrypt votes YES</div>
<div>></div>
<div>> On Thu, Jul 14, 2016 at 9:17 AM, Josh Aas <josh@letsencrypt.org> wrote:</div>
<div>>> Ballot 173 - Removal of requirement to cease use of private key due </div>
<div>>> to incorrect certificate info</div>
<div>>></div>
<div>>> The following motion has been proposed by Josh Aas of ISRG / Let's </div>
<div>>> Encrypt. Ben Wilson of Digicert and Chris Bailey of Entrust endorse.</div>
<div>>></div>
<div>>> Background:</div>
<div>>></div>
<div>>> BR Section 9.6.3 point 5 says:</div>
<div>>></div>
<div>>> "Reporting and Revocation: An obligation and warranty to promptly </div>
<div>>> cease using a Certificate and its associated Private Key, and </div>
<div>>> promptly request the CA to revoke the Certificate, in the event that:</div>
<div>>> (a) any information in the Certificate is, or becomes, incorrect or </div>
<div>>> inaccurate, or (b) there is any actual or suspected misuse or </div>
<div>>> compromise of the Subscriber’s Private Key associated with the Public </div>
<div>>> Key included in the Certificate;"</div>
<div>>></div>
<div>>> There is a problem here, which is that this requires a subscriber to </div>
<div>>> stop using a private key just because information in a certificate is </div>
<div>>> inaccurate or incorrect. People should stop using a cert with </div>
<div>>> inaccurate or incorrect information, but they shouldn't be required </div>
<div>>> to stop using a key pair unless there is known or suspected compromise.</div>
<div>>></div>
<div>>> This is particularly problematic for HPKP.</div>
<div>>></div>
<div>>> --Motion Begins--</div>
<div>>></div>
<div>>> Effective upon the date of passage, the following modifications are </div>
<div>>> made to the Baseline Requirements:</div>
<div>>></div>
<div>>> Change the following text in Section 9.6.3:</div>
<div>>> =======================</div>
<div>>> Reporting and Revocation: An obligation and warranty to promptly </div>
<div>>> cease using a Certificate and its associated Private Key, and </div>
<div>>> promptly request the CA to revoke the Certificate, in the event that:</div>
<div>>> (a) any information in the Certificate is, or becomes, incorrect or </div>
<div>>> inaccurate, or (b) there is any actual or suspected misuse or </div>
<div>>> compromise of the Subscriber’s Private Key associated with the Public </div>
<div>>> Key included in the Certificate; =======================</div>
<div>>></div>
<div>>> To:</div>
<div>>> =======================</div>
<div>>> Reporting and Revocation: An obligation and warranty to: (a) promptly </div>
<div>>> request revocation of the Certificate, and cease using it and its </div>
<div>>> associated Private Key, if there is any actual or suspected misuse or </div>
<div>>> compromise of the Subscriber’s Private Key associated with the Public </div>
<div>>> Key included in the Certificate; and (b) promptly request revocation </div>
<div>>> of the Certificate, and cease using it, if any information in the </div>
<div>>> Certificate is or becomes incorrect or inaccurate.</div>
<div>>> =======================</div>
<div>>></div>
<div>>> --Motion Ends--</div>
<div>>></div>
<div>>> The review period for this ballot shall commence at 2200 UTC on 14 </div>
<div>>> July 2016, and will close at 2200 UTC on 21 July 2016. Unless the </div>
<div>>> motion is withdrawn during the review period, the voting period will </div>
<div>>> start immediately thereafter and will close at 2200 UTC on 28 July </div>
<div>>> 2016. Votes must be cast by posting an on-list reply to this thread.</div>
<div>>></div>
<div>>> A vote in favor of the motion must indicate a clear 'yes' in the </div>
<div>>> response. A vote against must indicate a clear 'no' in the response.</div>
<div>>> A vote to abstain must indicate a clear 'abstain' in the response.</div>
<div>>> Unclear responses will not be counted. The latest vote received from </div>
<div>>> any representative of a voting member before the close of the voting </div>
<div>>> period will be counted. Voting members are listed here:</div>
<div>>> https://cabforum.org/members/</div>
<div>>></div>
<div>>> In order for the motion to be adopted, two thirds or more of the </div>
<div>>> votes cast by members in the CA category and greater than 50% of the </div>
<div>>> votes cast by members in the browser category must be in favor.</div>
<div>>> Quorum is currently ten (10) members– at least ten members must </div>
<div>>> participate in the ballot, either by voting in favor, voting against, or abstaining.</div>
<div>>></div>
<div>>> --</div>
<div>>> Josh Aas</div>
<div>>> Executive Director</div>
<div>>> Internet Security Research Group</div>
<div>>> Let's Encrypt: A Free, Automated, and Open CA</div>
<div>></div>
<div>></div>
<div>></div>
<div>> --</div>
<div>> Josh Aas</div>
<div>> Executive Director</div>
<div>> Internet Security Research Group</div>
<div>> Let's Encrypt: A Free, Automated, and Open CA</div>
<div> </div>
<div> </div>
<div> </div>
<div>--</div>
<div>Josh Aas</div>
<div>Executive Director</div>
<div>Internet Security Research Group</div>
<div>Let's Encrypt: A Free, Automated, and Open CA _______________________________________________</div>
<div>Public mailing list</div>
<div>Public@cabforum.org</div>
<div>https://cabforum.org/mailman/listinfo/public</div>
<div> </div>
<div> </div>
<div>_______________________________________________</div>
<div>Public mailing list</div>
<div>Public@cabforum.org</div>
<div>https://cabforum.org/mailman/listinfo/public</div>
</div></blockquote>
</body></html>