<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.m-929580061412658589line867, li.m-929580061412658589line867, div.m-929580061412658589line867
{mso-style-name:m_-929580061412658589line867;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.m-929580061412658589line874, li.m-929580061412658589line874, div.m-929580061412658589line874
{mso-style-name:m_-929580061412658589line874;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.m-929580061412658589msoplaintext, li.m-929580061412658589msoplaintext, div.m-929580061412658589msoplaintext
{mso-style-name:m_-929580061412658589msoplaintext;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.m-929580061412658589line862, li.m-929580061412658589line862, div.m-929580061412658589line862
{mso-style-name:m_-929580061412658589line862;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Per your request<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Sent:</b> Tuesday, October 25, 2016 2:06 PM<br>
<b>To:</b> Kirk Hall <Kirk.Hall@entrustdatacard.com><br>
<b>Cc:</b> public@cabforum.org<br>
<b>Subject:</b> Re: [cabfpub] Ballot 182 – Readopting BR 3.2.2.4 (Part 2)<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Last request for a redline version. Thanks :)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Oct 25, 2016 at 1:38 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="m-929580061412658589line867" style="margin:0in;margin-bottom:.0001pt;background:white">
<strong><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;font-weight:normal">This is the start of the 7 day discussion period for this Ballot. The Review Period under our IPR Policy will start on Nov. 1, and run for 60 days. I will
send out a formal Review Notice with Draft Guidelines on Nov. 1 with a template form of Exclusion Notice that Members may use.</span></strong><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="m-929580061412658589line867" style="margin:0in;margin-bottom:.0001pt;background:white">
<strong><span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">Ballot 182 – Readopting BR 3.2.2.4 (Part 2)</span></strong><o:p></o:p></p>
<p class="m-929580061412658589line867" style="margin:0in;margin-bottom:.0001pt;background:white">
<o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;background:white">
<span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">The following motion has been proposed by Kirk Hall of Entrust and endorsed by Peter Bowen of Amazon and Virginia Fournier of Apple as a Final Guideline:</span><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;background:white">
<span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;background:white">
<span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black">-- MOTION BEGINS –</span><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;background:white">
<span style="font-size:11.0pt;font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="m-929580061412658589msoplaintext"><span style="font-family:"Arial",sans-serif">In accordance with the Bylaws and Intellectual Property Rights (IPR) Policy of the CA/Browser Forum (the “Forum”), the Forum Baseline Requirements (BR) and Extended Validation
Guidelines (EVGL), as previously approved by all ballots up to and including Ballot 176, are hereby readopted by this Ballot, with the following amendments.</span><o:p></o:p></p>
<p class="m-929580061412658589msoplaintext"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="m-929580061412658589msoplaintext"><span style="font-family:"Arial",sans-serif">11. BR 3.2.2.4 is amended to read in its entirety as follows:</span><o:p></o:p></p>
<p class="m-929580061412658589msoplaintext"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<b><span style="font-family:"Arial",sans-serif;color:black">3.2.2.4 Validation of Domain Authorization or Control</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">This section defines the permitted processes and procedures for validating the Applicant's ownership or control of the domain.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">The CA SHALL confirm that, as of the date the Certificate issues, either the CA or a Delegated Third Party has validated each Fully-Qualified Domain Name (FQDN) listed in the Certificate using at least
one of the methods listed below.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Completed confirmations of Applicant authority may be valid for the issuance of multiple certificates over time. In all cases, the confirmation must have been initiated within the time period specified
in the relevant requirement (such as Section 3.3.1 of this document) prior to certificate issuance. For purposes of domain validation, the term Applicant includes the Applicant's Parent Company, Subsidiary Company, or Affiliate.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Note: FQDNs may be listed in Subscriber Certificates using dNSNames in the subjectAltName extension or in Subordinate CA Certificates via dNSNames in permittedSubtrees within the Name Constraints extension.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<b><span style="font-family:"Arial",sans-serif;color:black">3.2.2.4.1 Validating the Applicant as a Domain Contact</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Confirming the Applicant's control over the FQDN by validating the Applicant is the Domain Contact directly with the Domain Name Registrar. This method may only be used if:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">1.</span><span style="font-size:7.0pt;color:black">
</span><span style="font-family:"Arial",sans-serif;color:black">The CA authenticates the Applicant's identity under BR Section 3.2.2.1 and the authority of the Applicant Representative under BR Section 3.2.5, OR</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">2.</span><span style="font-size:7.0pt;color:black">
</span><span style="font-family:"Arial",sans-serif;color:black">The CA authenticates the Applicant's identity under EV Guidelines Section 11.2 and the agency of the Certificate Approver under EV Guidelines Section 11.8; OR</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">3.</span><span style="font-size:7.0pt;color:black">
</span><span style="font-family:"Arial",sans-serif;color:black">The CA is also the Domain Name Registrar, or an Affiliate of the Registrar, of the Base Domain Name.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.0in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<b><span style="font-family:"Arial",sans-serif;color:black">3.2.2.4.2 Email, Fax, SMS, or Postal Mail to Domain Contact</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Confirming the Applicant's control over the FQDN by sending a Random Value via email, fax, SMS, or postal mail and then receiving a confirming response utilizing the Random Value. The Random Value MUST
be sent to an email address, fax/SMS number, or postal mail address identified as a Domain Contact.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Each email, fax, SMS, or postal mail MAY confirm control of multiple Authorization Domain Names.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">The CA or Delegated Third Party MAY send the email, fax, SMS, or postal mail identified under this section to more than one recipient provided that every recipient is identified by the Domain Name Registrar
as representing the Domain Name Registrant for every FQDN being verified using the email, fax, SMS, or postal mail.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">The Random Value SHALL be unique in each email, fax, SMS, or postal mail.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">The CA or Delegated Third Party MAY resend the email, fax, SMS, or postal mail in its entirety, including re-use of the Random Value, provided that the communication's entire contents and recipient(s)
remain unchanged.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">The Random Value SHALL remain valid for use in a confirming response for no more than 30 days from its creation. The CPS MAY specify a shorter validity period for Random Values, in which case the CA MUST
follow its CPS.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<b><span style="font-family:"Arial",sans-serif;color:black">3.2.2.4.3 Phone Contact with Domain Contact</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Confirming the Applicant's control over the requested FQDN by calling the Domain Name Registrant's phone number and obtaining a response confirming the Applicant's request for validation of the FQDN.
The CA or Delegated Third Party MUST place the call to a phone number identified by the Domain Name Registrar as the Domain Contact.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Each phone call SHALL be made to a single number and MAY confirm control of multiple FQDNs, provided that the phone number is identified by the Domain Registrar as a valid contact method for every Base
Domain Name being verified using the phone call.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<b><span style="font-family:"Arial",sans-serif;color:black">3.2.2.4.4 Constructed Email to Domain Contact</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Confirm the Applicant's control over the requested FQDN by (i) sending an email to one or more addresses created by using 'admin', 'administrator', 'webmaster', 'hostmaster', or 'postmaster' as the local
part, followed by the at-sign ("@"), followed by an Authorization Domain Name, (ii) including a Random Value in the email, and (iii) receiving a confirming response utilizing the Random Value.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Each email MAY confirm control of multiple FQDNs, provided the Authorization Domain Name used in the email is an Authorization Domain Name for each FQDN being confirmed</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">The Random Value SHALL be unique in each email.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">The email MAY be re-sent in its entirety, including the re-use of the Random Value, provided that its entire contents and recipient SHALL remain unchanged.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">The Random Value SHALL remain valid for use in a confirming response for no more than 30 days from its creation. The CPS MAY specify a shorter validity period for Random Values, in which case the CA.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<b><span style="font-family:"Arial",sans-serif;color:black">3.2.2.4.5 Domain Authorization Document</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Confirming the Applicant's control over the requested FQDN by relying upon the attestation to the authority of the Applicant to request a Certificate contained in a Domain Authorization Document. The
Domain Authorization Document MUST substantiate that the communication came from the Domain Contact. The CA MUST verify that the Domain Authorization Document was either (i) dated on or after the date of the domain validation request or (ii) that the WHOIS
data has not materially changed since a previously provided Domain Authorization Document for the Domain Name Space.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<b><span style="font-family:"Arial",sans-serif;color:black">3.2.2.4.6 Agreed-Upon Change to Website</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Confirming the Applicant's control over the requested FQDN by confirming one of the following under the "/.well-known/pki-validation" directory, or another path registered with IANA for the purpose of
Domain Validation, on the Authorization Domain Name that is accessible by the CA via HTTP/HTTPS over an Authorized Port:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.75in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">1.</span><span style="font-size:7.0pt;color:black">
</span><span style="font-family:"Arial",sans-serif;color:black">The presence of Required Website Content contained in the content of a file or on a web page in the form of a meta tag. The entire Required Website Content MUST NOT appear in the request used to
retrieve the file or web page, or</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.75in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.75in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">2.</span><span style="font-size:7.0pt;color:black">
</span><span style="font-family:"Arial",sans-serif;color:black">The presence of the Request Token or Request Value contained in the content of a file or on a webpage in the form of a meta tag where the Request Token or Random Value MUST NOT appear in the request.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:1.25in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">If a Random Value is used, the CA or Delegated Third Party SHALL provide a Random Value unique to the certificate request and SHALL not use the Random Value after the longer of (i) 30 days or (ii) if
the Applicant submitted the certificate request, the timeframe permitted for reuse of validated information relevant to the certificate (such as in Section 3.3.1 of these Guidelines or Section 11.14.3 of the EV Guidelines).</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Note: Examples of Request Tokens include, but are not limited to: (i) a hash of the public key; (ii) a hash of the Subject Public Key Info [X.509]; and (iii) a hash of a PKCS#10 CSR. A Request Token may
also be concatenated with a timestamp or other data. If a CA wanted to always use a hash of a PKCS#10 CSR as a Request Token and did not want to incorporate a timestamp and did want to allow certificate key re-use then the applicant might use the challenge
password in the creation of a CSR with OpenSSL to ensure uniqueness even if the subject and key are identical between subsequent requests. This simplistic shell command produces a Request Token which has a timestamp and a hash of a CSR. E.g. echo date -u +%Y%m%d%H%M
sha256sum <r2.csr | sed "s/[ -]//g" The script outputs: 201602251811c9c863405fe7675a3988b97664ea6baf442019e4e52fa335f406f7c5f26cf14f The CA should define in its CPS (or in a document referenced from the CPS) the format of Request Tokens it accepts.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<b><span style="font-family:"Arial",sans-serif;color:black">3.2.2.4.7 DNS Change</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Confirming the Applicant's control over the requested FQDN by confirming the presence of a Random Value or Request Token in a DNS TXT or CAA record for an Authorization Domain Name or an Authorization
Domain Name that is prefixed with a label that begins with an underscore character.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">If a Random Value is used, the CA or Delegated Third Party SHALL provide a Random Value unique to the certificate request and SHALL not use the Random Value after (i) 30 days or (ii) if the Applicant
submitted the certificate request, the timeframe permitted for reuse of validated information relevant to the certificate (such as in Section 3.3.1 of these Guidelines or Section 11.14.3 of the EV Guidelines).</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<b><span style="font-family:"Arial",sans-serif;color:black">3.2.2.4.8 IP Address</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Confirming the Applicant's control over the requested FQDN by confirming that the Applicant controls an IP address returned from a DNS lookup for A or AAAA records for the FQDN in accordance with section
3.2.2.5.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<b><span style="font-family:"Arial",sans-serif;color:black">3.2.2.4.9 Test Certificate</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Confirming the Applicant's control over the requested FQDN by confirming the presence of a non-expired Test Certificate issued by the CA on the Authorization Domain Name and which is accessible by the
CA via TLS over an Authorized Port for the purpose of issuing a Certificate with the same Public Key as in the Test Certificate.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<b><span style="font-family:"Arial",sans-serif;color:black">3.2.2.4.10. TLS Using a Random Number</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in;background:white">
<span style="font-family:"Arial",sans-serif;color:black">Confirming the Applicant's control over the requested FQDN by confirming the presence of a Random Value within a Certificate on the Authorization Domain Name which is accessible by the CA via TLS over
an Authorized Port.</span><o:p></o:p></p>
<p class="m-929580061412658589msoplaintext"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="m-929580061412658589msoplaintext"><span style="font-family:"Arial",sans-serif">In the event that this Ballot and Ballot 181 are both approved by the Forum, the provisions of this Ballot shall supersede and replace any conflicting provisions of Ballot
181.</span><o:p></o:p></p>
<p class="m-929580061412658589msoplaintext"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="m-929580061412658589msoplaintext"><span style="font-family:"Arial",sans-serif">The proposer and endorsers of this Ballot may withdraw this Ballot at any time prior to completion of the final vote for approval, in which case the Ballot will not proceed
further.</span><o:p></o:p></p>
<p class="m-929580061412658589msoplaintext"><span style="font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt"><b><span style="font-size:11.0pt;font-family:"Arial",sans-serif">-- MOTION ENDS –
</span></b><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Arial",sans-serif">The procedure for this Maintenance Guideline ballot is as follows (exact start and end times may be adjusted to comply
with applicable Bylaws and IPR Agreement):</span><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td width="459" valign="top" style="width:229.25pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">BALLOT 182</span><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">Status: Final Guideline</span><o:p></o:p></p>
</td>
<td width="165" valign="top" style="width:82.4pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">Start time (22:00 UTC)</span><o:p></o:p></p>
</td>
<td width="177" valign="top" style="width:88.6pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">End time (22:00 UTC)</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="459" valign="top" style="width:229.25pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">Discussion (7 days)</span><o:p></o:p></p>
</td>
<td width="165" valign="top" style="width:82.4pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">Oct. 25, 2016</span><o:p></o:p></p>
</td>
<td width="177" valign="top" style="width:88.6pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">Nov. 1, 2016</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="459" valign="top" style="width:229.25pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">Review Period (Chair to send Review Notice) (60 days).
</span><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">If Exclusion Notice(s) filed, PAG to be created and no further action until PAG recommendations received.</span><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">If no Exclusion Notice(s) filed, proceed to:</span><o:p></o:p></p>
</td>
<td width="165" valign="top" style="width:82.4pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">Nov. 1, 2016</span><o:p></o:p></p>
</td>
<td width="177" valign="top" style="width:88.6pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">Dec. 31, 2016</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="459" valign="top" style="width:229.25pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">Vote for approval (7 days)</span><o:p></o:p></p>
</td>
<td width="165" valign="top" style="width:82.4pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">Dec. 31, 2016</span><o:p></o:p></p>
</td>
<td width="177" valign="top" style="width:88.6pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%;font-family:"Arial",sans-serif">Jan. 7, 2017</span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Arial",sans-serif">Votes must be cast by posting an on-list reply to this thread on the Public list.
</span><o:p></o:p></p>
<p class="m-929580061412658589line874" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="m-929580061412658589line862" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Arial",sans-serif">A vote in favor of the motion must indicate a clear 'yes' in the response. A vote against must indicate a clear 'no'
in the response. A vote to abstain must indicate a clear 'abstain' in the response. Unclear responses will not be counted. The latest vote received from any representative of a voting member before the close of the voting period will be counted. Voting members
are listed here: </span><a href="https://cabforum.org/members/" target="_blank"><span style="font-size:11.0pt;font-family:"Arial",sans-serif">https://cabforum.org/members/</span></a><span style="font-size:11.0pt;font-family:"Arial",sans-serif">
</span><o:p></o:p></p>
<p class="m-929580061412658589line862" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Arial",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Arial",sans-serif">In order for the motion to be adopted, two thirds or more of the votes cast by members in the CA category and greater than 50% of the
votes cast by members in the browser category must be in favor. <span style="color:black;background:white">
Quorum is currently ten (10) members – at least ten members must participate in the ballot, either by voting in favor, voting against, or abstaining.</span></span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>