<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">That’s good news, Ryan – some have said that no OIDs are permitted in certificates except for those specified in the BRs and/or RFC 5280, etc. I couldn’t see
where that was specified so I thought I’d check with the browsers. Sounds like Google has no objections to additional OIDs.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Assuming the other browsers take the same position, then in the future when a CA or a political jurisdiction wants extra markers in certificates for their own
purposes, the Forum and the browsers won’t have to get involved. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Do Microsoft, Apple, and Mozilla agree?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Sent:</b> Sunday, August 21, 2016 2:49 PM<br>
<b>To:</b> Kirk Hall <Kirk.Hall@entrust.com><br>
<b>Cc:</b> CABFPub <public@cabforum.org><br>
<b>Subject:</b> Re: [cabfpub] Additional OIDs in end-entity certificates<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Sun, Aug 21, 2016 at 2:14 PM, Kirk Hall <<a href="mailto:Kirk.Hall@entrust.com" target="_blank">Kirk.Hall@entrust.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On our recent teleconference, the Forum discussed what happens when there is a conflict between the naming requirements of the Baseline Requirements (generally at BR 7.1.4) and
a conflicting local or national requirement. The current issue will be discussed in the Minutes for the August 18 teleconference once approved, but it did occur to some of us that this kind of issue will arise again in the future.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">One place where if could arise is with the EU’s eIDAS requirements. See
<a href="https://en.wikipedia.org/wiki/EIDAS" target="_blank">https://en.wikipedia.org/wiki/EIDAS</a>
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">This email is not about eIDAS, but is intended to pose a simple question (mainly to the browsers): if a CA wants to include a new OID of its choosing in a certificate (such as
a specified eIDAS OID that means “This certificate complies with eIDAS regulations”), is there any reason not to allow that? I understand that the browsers may choose to ignore such a new OID (for example, the browsers may decide “we will not give this eIDAS
OID cert any special UI in the browser), but is there any technical reason for prohibiting CAs from including such extra OIDs in their certificates if they want to? Do we need to limit what OIDs can be included in an end-entity certificate – and if so, why?<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal">I'm not sure I understand your motivations for phrasing the question as you did, as it does seem somewhat separate from issued discussed in the (to be published) minutes. In particular, the concern was related to conflicting requirements,
rather than additive requirements.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There is nothing in the BRs that prohibits multiple OIDs from being asserted in the certificatePolicies extension; merely, that AT LEAST one of the OIDs maps back to the CA's CP/CPS to a policy that indicates compliance with the BRs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I think Jody gave me an explanation of why extra OIDs could be problematic for Windows, but I can’t remember what it was.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">What about Apple, Mozilla, Google? Any problems with CAs including an extra OID in a certificate? <o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Define problems? It would appear you're using the term to indicate technical problems, Baseline Requirements prohibitions, and general opinions/opposition. It's unclear if you're actually interested in the superset, or if you're trying
to find out a specific one of those.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">It's also unclear if you're trying to relate this to what was discussed (which I don't believe these questions do), based on your introduction of the topic, or if you're looking for clarification for an issue you recognize as orthogonal.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">If there are no problems, I think we should perhaps amend the BRs to make it clear extra OIDs are permitted.<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Could you please explain why you do not believe it's clear already? That is, what other interpretations from the language, as written, do you see, which would lead you to seeking clarification or rewording? Any attempt to make it clear
first has to understand why it isn't clear already, and whether that lack of clarity is due to the wording itself or a lack of familiarity with the technical standards.<o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>