<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.m-1763308945465395665m-3045134859279020391msolistparagraph, li.m-1763308945465395665m-3045134859279020391msolistparagraph, div.m-1763308945465395665m-3045134859279020391msolistparagraph
{mso-style-name:m_-1763308945465395665m-3045134859279020391msolistparagraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>There is a public file (in the link I provided), but it requires filling out information to access. It’s the HotSpot 2.0 Technical documentation, which includes the Certificate Policy (“Hostspot 2-0 (R2) OSU Certificate Policy Specification”). The documentation is already free to anyone who wants to enter information and agree to the terms of use. <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>We essentially already have a liaison member from the WFA (DigiCert, Microsoft, Apple, and Google are all members). <o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </o:p></span></a></p><span style='mso-bookmark:_MailEndCompose'></span><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> Ryan Sleevi [mailto:sleevi@google.com] <br><b>Sent:</b> Tuesday, January 3, 2017 1:39 PM<br><b>To:</b> Jeremy Rowley <jeremy.rowley@digicert.com><br><b>Cc:</b> CA/Browser Forum Public Discussion List <public@cabforum.org>; Peter Bowen <pzb@amzn.com><br><b>Subject:</b> Re: [cabfpub] Proposed Ballot 183 - Allowing 822 Names and (limited) otherNames<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>I guess I would be more precise: Can you specify a specific document to adhere to? A specific (public) process to evaluate?<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I think finding support for this is mostly about finding ways to minimize risk for misissuance.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Should we expect/desire to have a liason member from the WFA? Should we encourage/require that such specifications be freely available in order to make use of / share the Web PKI? How do we avoid a situation, say, in N years, where the WFA members are asking for special exceptions to whatever the latest deprecation is?<o:p></o:p></p></div></div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On Tue, Jan 3, 2017 at 12:32 PM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><p class=m-1763308945465395665m-3045134859279020391msolistparagraph><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>They don’t publish a lot of information publicly. The documentation for how they use friendly-names is here: <a href="https://www.wi-fi.org/discover-wi-fi/wi-fi-certified-passpoint" target="_blank">https://www.wi-fi.org/discover-wi-fi/wi-fi-certified-passpoint</a>. As WFA is an actual organization, a single mebmer saying something okay is not the same as the entity approving something, but I see your point. Perhaps something that specifies it must be ratified and published (</span><span style='font-size:7.0pt'> </span><u>For each id-wfa-hotspot-friendlyName entry, the CA MUST only include entries after receiving permission from the WiFi Alliance to utilize the id-wfa-hotspot-friendlyName type and MUST verify each entry in accordance with the requirements ratified and published by the WiFi Alliance. )?</u><o:p></o:p></p><div><div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b>7.1.4.2.1. Subject Alternative Name Extension </b><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Certificate Field: extensions:subjectAltName <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Required/Optional: Required <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Contents: This extension MUST contain at least one entry. Each entry MUST be <u>one of the following entries: 1) </u><s>either </s>a dNSName containing the Fully<span style='font-family:"Cambria Math",serif'>‐</span>Qualified Domain Name<u> or a Wildcard Domain Name, 2) </u><s> or </s>an iPAddress containing the IP address of a server,<u>3) a rfc822Name containing an RFC 5322 email address, 4) an otherName with a id-wfa-hotspot-friendlyName type { 1.3.6.1.4.1.40808.1.1.1 } or 5) an otherName of type SRVName as defined in RFC4986. </u> <u>T</u>he CA MUST confirm <u>each entry as follows:</u><o:p></o:p></p><p class=m-1763308945465395665m-3045134859279020391msolistparagraph>A)<span style='font-size:7.0pt'> </span><u>For each dNSName entry, the CA MUST verify the entry in accordance with Section 3.2.2.4;</u><o:p></o:p></p><p class=m-1763308945465395665m-3045134859279020391msolistparagraph>B)<span style='font-size:7.0pt'> </span><u>For each SRVName entry, the CA MUST verify the Name portion of the entry in accordance with Section 3.2.2.4;</u><o:p></o:p></p><p class=m-1763308945465395665m-3045134859279020391msolistparagraph>C)<span style='font-size:7.0pt'> </span><u>For each iPAddress entry, the CA MUST verify the entry in accordance with Section 3.2.2.5;</u><o:p></o:p></p><p class=m-1763308945465395665m-3045134859279020391msolistparagraph>D)<span style='font-size:7.0pt'> </span><u>For each id-wfa-hotspot-friendlyName entry, the CA MUST only include entries after receiving permission from the WiFi Alliance to utilize the id-wfa-hotspot-friendlyName type and MUST verify each entry in accordance with the requirements ratified and published by the WiFi Alliance. </u><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <u>As an exception to RFC5280 and X.509, dNSName entries MAY contain Wildcard Domain Names. SRVName entries MUST NOT contain Wildcard Domain Names. If a name constrained CA has a dNSNAme constrain but does not have a constraint for SRVNames, the CA MUST NOT issue certificates containing SRVNames.</u><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <s>that the Applicant controls the Fully</s><s><span style='font-family:"Cambria Math",serif'>‐</span>Qualified Domain Name or IP address or has been granted the right to use it by the Domain Name Registrant or IP address assignee, as appropriate. Wildcard FQDNs are permitted. </s><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <u>For dNSNames, SRVNames, and iPAddress entries: </u><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>As of the Effective Date of these Requirements, prior to the issuance of a Certificate with a subjectAlternativeName extension or Subject commonName field containing a Reserved IP Address or Internal Name, the CA SHALL notify the Applicant that the use of such Certificates has been deprecated by the CA / Browser Forum and that the practice will be eliminated by October 2016. Also as of the Effective Date, the CA SHALL NOT issue a certificate with an Expiry Date later than 1 November 2015 with a subjectAlternativeName extension or Subject commonName field containing a Reserved IP Address or Internal Name. Effective 1 October 2016, CAs SHALL revoke all unexpired Certificates whose subjectAlternativeName extension or Subject commonName field contains a Reserved IP Address or Internal Name. Effective May 1, 2015, each CA SHALL revoke all unexpired Certificates with an Internal Name using onion as the right<span style='font-family:"Cambria Math",serif'>‐</span>most label in an entry in the subjectAltName Extension or commonName field unless such Certificate was issued in accordance with Appendix F of the EV Guidelines.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:11.4pt'> <o:p></o:p></p></div></div></blockquote></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div></div></div></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>