<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><font face="Calibri">+1</font><br>
</p>
<br>
<div class="moz-cite-prefix">Il 09/11/2016 14:40, Doug Beattie via
Public ha scritto:<br>
</div>
<blockquote
cite="mid:SG2PR0301MB1015A39F458F676EEB094EE2F0B90@SG2PR0301MB1015.apcprd03.prod.outlook.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
p.line874, li.line874, div.line874
{mso-style-name:line874;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
p.line862, li.line862, div.line862
{mso-style-name:line862;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
span.anchor
{mso-style-name:anchor;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;
color:black;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1052390341;
mso-list-type:hybrid;
mso-list-template-ids:-1697057798 67698705 67698689 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1
{mso-list-id:1225795352;
mso-list-template-ids:-542343092;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Gerv,<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I
have a few comments:<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoListParagraph"
style="text-indent:-.25in;mso-list:l0 level1 lfo2"><!--[if !supportLists]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><span
style="mso-list:Ignore">1)<span style="font:7.0pt
"Times New Roman"">
</span></span></span><!--[endif]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">We’ve
gone from at the time of validation (up to 39 months, which
I agree is unreasonable) to a few days (I think Ryan
suggested this) to 10 minutes. I recommend we increase this
back to a few days (let’s say 3). This will allow more
flexibility in the location of this check in the overall
process, reduce the number duplicate checks CAs need to make
(one when order is placed, again when validated (maybe) and
one when issued) and will help reduce the “last minute”
checks that need to be done and which can impact issuance.
I think a few days still allows a sufficiently short cache
time that this should address domain owners concerns for
rolling out updated CAA records. What’s driving the 10
minute requirement?<o:p></o:p></span></p>
<p class="MsoListParagraph"
style="text-indent:-.25in;mso-list:l0 level1 lfo2"><!--[if !supportLists]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><span
style="mso-list:Ignore">2)<span style="font:7.0pt
"Times New Roman"">
</span></span></span><!--[endif]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I
think there should be a provision that CAA can be done
contractually such that those customers that own the domain
can provide CAA approval for their Domain Name to the CA so
that each of the FQDNs don’t need to be checked at issuance
time, for the duration of the contract. Mozilla allows this
type of flexibility when issuing client certificates:<o:p></o:p></span></p>
<p class="MsoListParagraph"
style="margin-left:1.0in;text-indent:-.25in;mso-list:l0 level2
lfo2">
<!--[if !supportLists]--><span
style="font-size:11.0pt;font-family:Symbol;color:#1F497D"><span
style="mso-list:Ignore">·<span style="font:7.0pt
"Times New Roman"">
</span></span></span><!--[endif]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">“…the
CA takes reasonable measures to verify that the entity
submitting the request controls the email account associated
with the email address referenced in the certificate <u>o</u>r
has been authorized by the email account holder to act on
the account holder’s behalf<o:p></o:p></span></p>
<p class="MsoListParagraph"
style="text-indent:-.25in;mso-list:l0 level1 lfo2"><!--[if !supportLists]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><span
style="mso-list:Ignore">3)<span style="font:7.0pt
"Times New Roman"">
</span></span></span><!--[endif]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I
strongly object to this statement – why should blocking
issuance for a CAA record be any different than blocking
issuance based on key word or high risk checks? I can’t
support this – why does CABF need the results of CAA checks?<o:p></o:p></span></p>
<p class="MsoListParagraph"
style="margin-left:1.0in;text-indent:-.25in;mso-list:l0 level2
lfo2">
<!--[if !supportLists]--><span
style="font-size:11.0pt;font-family:Symbol;color:#1F497D"><span
style="mso-list:Ignore">·<span style="font:7.0pt
"Times New Roman"">
</span></span></span><!--[endif]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">CAs
MUST log issuances that were prevented by an adverse CAA
record in sufficient detail
<b><u>to provide feedback to the CAB Forum on the
circumstances</u></b><o:p></o:p></span></p>
<p class="MsoListParagraph"
style="text-indent:-.25in;mso-list:l0 level1 lfo2"><!--[if !supportLists]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><span
style="mso-list:Ignore">4)<span style="font:7.0pt
"Times New Roman"">
</span></span></span><!--[endif]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Specifying
what is logged is a bit over the top also. The requirement
should be to perform CAA and not drive implementation on
what is logged. I searched the BRs for logging requirements
and there no existing logging requirements this specific, so
I recommend these statements should be dropped:<o:p></o:p></span></p>
<p class="MsoListParagraph"
style="margin-left:1.0in;text-indent:-.25in;mso-list:l0 level2
lfo2">
<!--[if !supportLists]--><span
style="font-size:11.0pt;font-family:Symbol;color:#1F497D"><span
style="mso-list:Ignore">·<span style="font:7.0pt
"Times New Roman"">
</span></span></span><!--[endif]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">CAs
MUST keep records of the responses to all CAA DNS requests<o:p></o:p></span></p>
<p class="MsoListParagraph"
style="margin-left:1.0in;text-indent:-.25in;mso-list:l0 level2
lfo2">
<!--[if !supportLists]--><span
style="font-size:11.0pt;font-family:Symbol;color:#1F497D"><span
style="mso-list:Ignore">·<span style="font:7.0pt
"Times New Roman"">
</span></span></span><!--[endif]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">CAs
MUST log issuances that were prevented by an adverse CAA
record<o:p></o:p></span></p>
<p class="MsoListParagraph"
style="margin-left:1.0in;text-indent:-.25in;mso-list:l0 level2
lfo2">
<!--[if !supportLists]--><span
style="font-size:11.0pt;font-family:Symbol;color:#1F497D"><span
style="mso-list:Ignore">·<span style="font:7.0pt
"Times New Roman"">
</span></span></span><!--[endif]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Section
2.2 “The CA SHALL log all actions taken, if any, consistent
with its processing practice”<o:p></o:p></span></p>
<p class="MsoListParagraph"
style="text-indent:-.25in;mso-list:l0 level1 lfo2"><!--[if !supportLists]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><span
style="mso-list:Ignore">5)<span style="font:7.0pt
"Times New Roman"">
</span></span></span><!--[endif]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I
don’t understand this statement:<o:p></o:p></span></p>
<p class="MsoListParagraph"
style="margin-left:1.0in;text-indent:-.25in;mso-list:l0 level2
lfo2">
<!--[if !supportLists]--><span
style="font-size:11.0pt;font-family:Symbol;color:#1F497D"><span
style="mso-list:Ignore">·<span style="font:7.0pt
"Times New Roman"">
</span></span></span><!--[endif]--><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">“It
shall clearly specify the set of Issuer Domain Names that
the CA recognises as permitting it to issue.”<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Doug<o:p></o:p></span></p>
<p class="MsoNormal"><a moz-do-not-send="true"
name="_MailEndCompose"><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></a></p>
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">From:</span></b><span
style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtext">
Public [<a class="moz-txt-link-freetext" href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Gervase Markham via Public<br>
<b>Sent:</b> Monday, November 7, 2016 11:02 AM<br>
<b>To:</b> CABFPub <a class="moz-txt-link-rfc2396E" href="mailto:public@cabforum.org"><public@cabforum.org></a><br>
<b>Cc:</b> Gervase Markham <a class="moz-txt-link-rfc2396E" href="mailto:gerv@mozilla.org"><gerv@mozilla.org></a><br>
<b>Subject:</b> [cabfpub] Draft CAA motion<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hi everyone,<br>
<br>
Here's a draft motion to make CAA mandatory. We may not be
able to start the process properly for a while, but I'd like
to get the motion text ironed out.<br>
<br>
Gerv<o:p></o:p></p>
<p class="line874"><b>Ballot XXX - Make CAA Checking Mandatory</b><o:p></o:p></p>
<p class="line862">The following motion has been proposed by
Gervase Markham of Mozilla and endorsed by XXX of XXX and XXX
of XXX:
<o:p></o:p></p>
<p class="line874"><b>Statement of Intent</b>: <o:p></o:p></p>
<p class="MsoNormal">Certificate Authority Authorization (CAA)
is a DNS Resource Record defined in RFC 6844 -
<a moz-do-not-send="true"
href="https://datatracker.ietf.org/doc/rfc6844/">https://datatracker.ietf.org/doc/rfc6844/</a>
, published in January 2013. It allows a DNS domain name
holder to specify one or more Certification Authorities (CAs)
authorized to issue certificates for that domain and, by
consequence, that no other CAs are authorized.<br>
<br>
The intent of this motion is to make it mandatory for CAs to
check CAA records at issuance time for all certificates
issued, and to prevent issuance if a CAA record is found which
does not permit issuance by that CA. This therefore allows
domain owners to set an issuance policy which will be
respected by all publicly-trusted CAs, and allows them to
mitigate the problem that the public CA trust system is only
as strong as its weakest CA.<br>
<br>
Note that CAA is already a defined term in the BRs and so does
not need definitional text to be provided by this motion.
<o:p></o:p></p>
<p class="line874"><b>-- MOTION BEGINS --</b> <o:p></o:p></p>
<p class="MsoNormal">Add the following text to section XXX
("XXX") of the Baseline Requirements:<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">As part of the issuance process, after
all other validation has been completed. The CA must check
for a CAA record for all domains in the certificate
according to the procedure in RFC 6844, following the
processing instructions set down in RFC 6844 for any records
found. If the CA issues, they must do so within 10<br>
minutes of the check passing.<br>
<br>
This stipulation does not prevent the CA from checking CAA
records at other points in the issuance process.<br>
<br>
RFC 6844 requires that CAs "MUST NOT issue a certificate
unless either (1) the certificate request is consistent with
the applicable CAA Resource Record set or (2) an exception
specified in the relevant Certificate Policy or
Certification Practices Statement applies." For issuances
conforming to these Baseline Requirements, CAs MUST NOT rely
on any exceptions specified in their CP or CPS.<br>
<br>
CAs MUST keep records of the responses to all CAA DNS
requests. CAs are permitted to treat a record lookup failure
as permission to issue if:<o:p></o:p></p>
<ul type="disc">
<li class="MsoNormal"
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1
level1 lfo1">
the failure is outside the CA's infrastructure; <o:p></o:p></li>
<li class="MsoNormal"
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1
level1 lfo1">
the lookup has been retried at least once; and <o:p></o:p></li>
<li class="MsoNormal"
style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1
level1 lfo1">
the domain does not use DNSSEC.<o:p></o:p></li>
</ul>
<p class="MsoNormal">CAs MUST log issuances that were
prevented by an adverse CAA record in sufficient detail to
provide feedback to the CAB Forum on the circumstances, and
SHOULD report such requests to the contact(s) stipulated in
the CAA iodef record(s), if present. CAs are not expected to
support URL schemes in the iodef record other than mailto:
or https:.<o:p></o:p></p>
</blockquote>
<p class="MsoNormal">Update section 2.2 ("Publication of
Information") of the Baseline Requirements, to remove the
following text:<o:p></o:p></p>
<pre> Effective as of 15 April 2015, section 4.2 of a CA's Certificate Policy and/or Certification <o:p></o:p></pre>
<pre> Practice Statement (section 4.1 for CAs still conforming to RFC 2527) SHALL state whether <o:p></o:p></pre>
<pre> the CA reviews CAA Records, and if so, the CA’s policy or practice on processing CAA Records <o:p></o:p></pre>
<pre> for Fully Qualified Domain Names. The CA SHALL log all actions taken, if any, consistent with <o:p></o:p></pre>
<pre> its processing practice. <o:p></o:p></pre>
<p class="MsoNormal">and replace it with: <o:p></o:p></p>
<pre> Effective as of XXX, section 4.2 of a CA's Certificate Policy and/or Certification <o:p></o:p></pre>
<pre> Practice Statement (section 4.1 for CAs still conforming to RFC 2527) SHALL state that <o:p></o:p></pre>
<pre> the CA reviews CAA Records for all issuances, and the CA’s policy or practice on processing CAA Records <o:p></o:p></pre>
<pre> for Fully Qualified Domain Names. It shall clearly specify the set of Issuer Domain Names that the CA<o:p></o:p></pre>
<pre> recognises as permitting it to issue. The CA SHALL log all actions taken, if any, consistent with <o:p></o:p></pre>
<pre> its processing practice. <o:p></o:p></pre>
<pre><o:p> </o:p></pre>
<pre>Add the following text to the appropriate place in section 1.6.3 ("References"):<o:p></o:p></pre>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">RFC6844, Request for Comments: 6844, DNS
Certification Authority Authorization (CAA) Resource Record,
Hallam-Baker, Stradling, January 2013.
<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><b>-- MOTION ENDS -- </b><o:p></o:p></p>
<p class="line874">The review period for this ballot shall
commence at 2200 UTC on XXX, and will close at 2200 UTC on
XXX. Unless the motion is withdrawn during the review period,
the voting period will start immediately thereafter and will
close at XXX. Votes must be cast by posting an on-list reply
to this thread. <o:p></o:p></p>
<p class="line862">A vote in favor of the motion must indicate a
clear 'yes' in the response. A vote against must indicate a
clear 'no' in the response. A vote to abstain must indicate a
clear 'abstain' in the response. Unclear responses will not be
counted. The latest vote received from any representative of a
voting member before the close of the voting period will be
counted. Voting members are listed here:
<a moz-do-not-send="true" href="https://cabforum.org/members/">https://cabforum.org/members/</a>
<o:p></o:p></p>
<p class="MsoNormal">In order for the motion to be adopted, two
thirds or more of the votes cast by members in the CA category
and greater than 50% of the votes cast by members in the
browser category must be in favor. Quorum is currently XXX
members – at least that many members must participate in the
ballot, either by voting in favor, voting against, or
abstaining.
<o:p></o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<p style="font-family: Serif">
Cordiali saluti,<br>
<br>
Adriano Santoni<br>
ACTALIS S.p.A.<br>
(Aruba Group)</p>
</div>
</body>
</html>