<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><font face="Calibri">Thank you, Peter, for your comments. <br>
</font></p>
<p><font face="Calibri">What you write seems to me clearer that the
EVGLs, and this further strengthens my conviction that EVGLs are
not very clear in §14.2.</font></p>
<p><font face="Calibri">For example, "validated EV scope" seems to
me a good and useful expression, not currently used in the
EVGLs.</font><br>
</p>
However, see below....<br>
<br>
<div class="moz-cite-prefix">Il 29/08/2016 16:14, Peter Bowen ha
scritto:<br>
</div>
<blockquote cite="mid:32877E43-9255-4DB4-883A-61F8B9B2E764@amzn.com"
type="cite">
<pre wrap="">Adriano,
My understanding is that there are two classes of RAs:
- Enterprise RAs
- Unconstrained RAs</pre>
</blockquote>
This is sufficiently clear in the EVGLs, although the adjective
"Unconstrained" is not used in them.<br>
<blockquote cite="mid:32877E43-9255-4DB4-883A-61F8B9B2E764@amzn.com"
type="cite">
<pre wrap="">
Unconstrained RAs can independently obtain and review evidence to determine who controls or owns a domain. The CA may, when receiving an authenticated issuance request from an Unconstrained RA, issue the certificate with no further checks. In order to help assure that the Unconstrained RA is following the requirements of the CA, to include the CA/Browser Forum requirements, the Unconstrained RA must undergo an audit very similar to that which the CA undergoes.</pre>
</blockquote>
This is clear, and I am aware of this. I think it was also clear
that I was referring to Enterprise RAs only.<br>
<blockquote cite="mid:32877E43-9255-4DB4-883A-61F8B9B2E764@amzn.com"
type="cite">
<pre wrap="">
Enterprise RAs were defined because the burden of audit was seen as too great for most cases. An Enterprise RA has a defined scope and is responsible for the validation of authority within that scope. The CA (or Unconstrained RA) is responsible for validating that the Enterprise RA operator is authorized to be the authority for the namespace(s) covering certificates the Enterprise RA authorizes. The EV Guidelines ensure that the CA is liable this action by requiring the CA to issue an EV certificate containing the Enterprise RA operator information. This ensures that the full Extended Validation process has been followed.</pre>
</blockquote>
This is already clear in the EVGLs, and perfectly reasonable.<br>
<blockquote cite="mid:32877E43-9255-4DB4-883A-61F8B9B2E764@amzn.com"
type="cite">
<pre wrap="">
Once the Enterprise RA’s scope has been validated, they can issue for anything within that scope, including the scope itself. </pre>
</blockquote>
The current EVGLs (§14.2.2) allow an Enterprise RA to ".... issue
additional EV Certificates at _third and higher domain levels_ that
are contained within the domain of the original EV Certificate". <br>
If the "original EV Certificate" is issued for a 2nd level domain,
that domain is the "scope"; and based on current EVGLs, the
Enterprise RA can then only request further EV certs at "third and
higher domain levels", not for "the scope itself".<br>
Does not seem to me quite the same thing that you write above, or at
least the current EVGLs language is ambiguous (at best).<br>
Pls note that I like your interpretation, but it does not seem what
the EVGLs are saying right now.<br>
<br>
<blockquote cite="mid:32877E43-9255-4DB4-883A-61F8B9B2E764@amzn.com"
type="cite">
<pre wrap="">For example, if I operate an Enterprise RA with a validated EV scope of “webpki.com”, I can validate an EV certificate request for “webpki.com” [see above], “shop.webpki.com”, “router.lhr.webpki.com”, or “www.webpki.com”. </pre>
</blockquote>
See above.<br>
<blockquote cite="mid:32877E43-9255-4DB4-883A-61F8B9B2E764@amzn.com"
type="cite">
<pre wrap="">However I cannot do initial validation for “sslmap.com” even though I own that domain as well; instead someone with an audited process must add it to my validated EV scope list at which point I can validate an EV certificate request for “sslmap.com” or “gateway.lax.sslmap.com”.</pre>
</blockquote>
I never suggested that, at this point, you (assuming you were the
Enterprise RA) could do initial validation for "sslmap.com" by
youself. That would still be up to the CA. <br>
Only *after* the CA has done initial validation for "sslmap.com",
you would be allowed to also issue for "sslmap.com" as an Enterprise
RA.<br>
<blockquote cite="mid:32877E43-9255-4DB4-883A-61F8B9B2E764@amzn.com"
type="cite">
<pre wrap="">
As I pointed out before, there is nothing that says the EV certificate(s) defining the validation scope must be publicly used or even be usable by common clients. It would be completely valid to put a “poison” extension that renders it unusable with clients and ensures that the only purpose is to assert the scope. I think a very sane implementation of Enterprise RA might choose this method, then have the Enterprise RA use this certificate and associated private key to sign issuance requests it has validated.</pre>
</blockquote>
This is quite interesting, but it seems to me a rather creative
reading of the EVGLs, maybe just because I am not aware of this
being the normal way.<br>
Are you willing to make a concrete example, possibly a real world
one?<br>
<br>
Besides, if this is a recommendable implementation of §14.2, then
It'd better be described in the EVGLs.<br>
<br>
<blockquote cite="mid:32877E43-9255-4DB4-883A-61F8B9B2E764@amzn.com"
type="cite">
<pre wrap="">
Given that Enterprise RAs are unaudited entities which have no defined oversight, why should they have the authority to issue for any name without further checks?</pre>
</blockquote>
I never suggested or implied that Enterprise RAs should be allowed
to issue "for any name without further checks".<br>
<blockquote cite="mid:32877E43-9255-4DB4-883A-61F8B9B2E764@amzn.com"
type="cite">
<pre wrap="">
Thanks,
Peter
</pre>
<blockquote type="cite">
<pre wrap="">On Aug 29, 2016, at 1:31 AM, Adriano Santoni <a class="moz-txt-link-rfc2396E" href="mailto:adriano.santoni@staff.aruba.it"><adriano.santoni@staff.aruba.it></a> wrote:
3) At any rate, even under the conditions above, once a subject organization has been enabled as an Enterprise RA for EV cert, they can only obtain EV certs for sub-domains of the SLDN contained in their first EV certificate.
Why so? Why cannot the Enterprise RA, at this point, obtain further EV certs for just any domain (esp. SLDN) they own or control? But if this is actually allowed, than it's certainly not clear in the EVGLs.
Adriano
Il 24/08/2016 18:59, Ryan Sleevi ha scritto:
</pre>
<blockquote type="cite">
<pre wrap="">Adriano,
It might be useful if you could explain more why you believe the text disagrees with Kirk, Peter and I. The goal is not to leave these things up to interpretation, and so if you believe a plain reading of the text supports an alternative understanding different from what we said, understanding why you believe that will be quite important.
On Wed, Aug 24, 2016 at 2:44 AM, Adriano Santoni <a class="moz-txt-link-rfc2396E" href="mailto:adriano.santoni@staff.aruba.it"><adriano.santoni@staff.aruba.it></a> wrote:
Kirk,
thank you for your contribute.
If the "correct interpretation" of the EVGL is actually the one you give below, than it makes sense.
But I see that even you are expressing some uncertainty ("looks like"... "in my opinion" ...) so I really would like to understand whether your interpretation is shared by most CA members, as I hope.
If your interpretation is correct, I think that the EVGLs are worth improving, for better clarity.
On the other hand, the notion that an Enterprise RA can only authorize issuance of EV certs for sub-domains seems weird to me.
I wonder how many EV certificates exist for subdomains of a company's main domain.... I suppose not many?
Adriano
Il 17/08/2016 18:56, Kirk Hall ha scritto:
</pre>
<blockquote type="cite">
<pre wrap="">Adriano, I may not be understanding your original question -- but here is another possible answer.
If Company A applies for an EV cert for foo.com, the CA will do an EV vetting for the organization (Company A) and then for the domain (foo.com). Under EVGL 14.2, it looks like Company A can then ask to be designated as an Enterprise RA - but only for the confirmed domain foo.com -- and then get certs for third level and higher domains that end in foo.com. But Company A has not proven ownership or control of any other domains, such as bar.com, so is not an Enterprise RA for any other domains.
Now suppose Company A comes back to the RA and asks for a cert for bar.com. In my opinion, the CA is not required to re-do EV organization validation for Company A again -- it can rely on the earlier EV organization validation (for the full 13 month period), so long as the CA is certain it is really dealing with Company A. But it must do EV validation of bar.com to prove it is owned or controlled by Company A. Once that has been done, Company A could ask to be designated as an Enterprise RA for bar.com also. But there is no real connection between the status of foo.com versus bar.com, other than Company A may only have to go through a single EV organization vetting.
Is that responsive to your original question?
-----Original Message-----
From: <a class="moz-txt-link-abbreviated" href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [<a class="moz-txt-link-freetext" href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>] On Behalf Of Peter Bowen
Sent: Friday, August 5, 2016 9:19 AM
To: Adriano Santoni <a class="moz-txt-link-rfc2396E" href="mailto:adriano.santoni@staff.aruba.it"><adriano.santoni@staff.aruba.it></a>
Cc: CABFPub <a class="moz-txt-link-rfc2396E" href="mailto:public@cabforum.org"><public@cabforum.org></a>
Subject: Re: [cabfpub] EV Guidelines §14.2 delegation of functions to RAs etc.
I don’t think this is a very high bar. It would seem the following process would work:
1) Customer requests EV Enterprise RA privileges for example.com, example.net, corp.example.org, example.biz, …
2) CA follows EV issuance procedures and issues a single EV certificate that has all the base domains in it. This certificate could have a CA-defined critical extension marking it an “Enterprise RA EV” certificate or some such to prevent it from being used on a server. I think it could even have CA-generated key pair where the CA simply threw away the private key after generation.
3) If the customer wants new domains, the CA issues a new “Enterprise RA EV” certificate using the same process. There does not appear to be a requirement that all domains be in a single certificate, so it could just be the new domains.
I think this would meet all the requirements that are set out.
Thanks,
Peter
</pre>
<blockquote type="cite">
<pre wrap="">On Aug 4, 2016, at 11:58 PM, Adriano Santoni <a class="moz-txt-link-rfc2396E" href="mailto:adriano.santoni@staff.aruba.it"><adriano.santoni@staff.aruba.it></a> wrote:
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Ok,. but what is (was) the ratio for that constraint?
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Assume the following:
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">1) A certain company (say "ACME Corp") owns/controls several 2nd level domains (two or more).
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">2) That company wants EV certificates, from a certain CA, for two or more of those domains, or possibly all of them.
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">3) The same company would like to be authorized as an Enterprise RA by the said CA.
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Now assume that the said CA, first of all, verifies (with _positive result_) that *all* of those domains are actually owned/controlled by ACME.
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Next, the CA verifies that all requirements for issuing the first EV certificate (for any one of those domains) are met, and therefore issues the first EV certificate.
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">At this point, why should ACME not be allowed to act as an Enterprise RA and thus obtain by themselves (in compliance with all applicable reqs. for Enterprise RAs) the desired EV certificates for the remaining 2nd level domains ?
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">What would be the implied risk of allowing that?
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Adriano
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Il 04/08/2016 23:24, Ryan Sleevi ha scritto:
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">You're saying the original certificate is xxx.example, and the new certificate is for xxx.example and yyy.example?
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">No, it would not be appropriate, because yyy.example was not "contained within the domain of the original EV certificate"
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">On Thu, Aug 4, 2016 at 6:19 AM, Adriano Santoni <a class="moz-txt-link-rfc2396E" href="mailto:adriano.santoni@staff.aruba.it"><adriano.santoni@staff.aruba.it></a> wrote:
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">All,
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">I have a doubt regarding §14.2 of EV guidelines, and particularly §14.2.2 (Enterprise RAs) that reads:
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">"The CA MAY contractually authorize the Subject of a specified Valid EV Certificate to perform the RA function and authorize the CA to issue additional EV Certificates at third and higher domain levels that are contained within the domain of the original EV Certificate (also known as an Enterprise EV Certificate). In such case, the Subject SHALL be considered an Enterprise RA, and the following requirements SHALL apply: ..."
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">Now, let's assume that a certain company owns/controls two or more domains, say xxx.com and yyy.net, and that the "original EV Certificate" (quoted from above) was issued by the CA for any one of those domains (say xxx.com): under these conditions, would it be okay to authorize that company to act as an Enterprise RA for the remaining 2nd-level domains that it owns/controls ?
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">Based on §14.2.2, it seems not.
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">Adriano
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">_______________________________________________
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">Public mailing list
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap=""><a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap=""><a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">--
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Cordiali saluti,
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Adriano Santoni
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">ACTALIS S.p.A.
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">(Aruba Group)
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">_______________________________________________
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Public mailing list
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap=""><a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap=""><a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<pre wrap="">
_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<pre wrap="">
--
Cordiali saluti,
Adriano Santoni
ACTALIS S.p.A.
(Aruba Group)
_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<pre wrap="">
--
Cordiali saluti,
Adriano Santoni
ACTALIS S.p.A.
(Aruba Group)
_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<p style="font-family: Serif">
Cordiali saluti,<br>
<br>
Adriano Santoni<br>
ACTALIS S.p.A.<br>
(Aruba Group)</p>
</div>
</body>
</html>