<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Bonjour,
<div class=""><br class="">
</div>
<div class="">Reading the Certificate Policy Specification v1.1 brings some questions.</div>
<div class=""><br class="">
</div>
<div class="">« Hotspot 2.0 »-devices will probably include some specific root CA certificates (3 of them exist, DigiCert's is trusted by Microsoft since April 2016), this ballot is about allowing issuance of TLS certificates containing the Hotspot-FriendlyName
SAN, so I guess there is some kind of bridge being made between « Hotspot 2.0 » and the WebPKI.</div>
<div class=""><br class="">
</div>
<div class=""> - Hotspot 2.0 Root Certificates don’t follow CABF BR in the subject field; HS2.0 require « C=US, O=WFA Hotspot 2.0, CN=Hotspot 2.0 Trust Root CA - <ID#> », where CABF BR clause 7.1.2.1 has different expectations on C and O</div>
<div class=""> - HS2.0 Intermediate Certificates again don’t follow CABF BR for the NameConstraints extension; HS2.0 states that this extension shall not be critical, when CABF BR states that it SHOULD be critical; please keep in mind that RFC5280 says it MUST
be critical, CABF has reduced this requirement to a SHOULD to accommodate Apple devices; now that recent versions of MacOS and iOS support the NC extension, is it really a good sign to lower again the requirements on this extension?</div>
<div class=""> - HS2.0 Intermediate Certificates let the CRLDP extension to be optional, when it’s mandatory for CABF BR</div>
<div class=""> - there has been some effort to standardize the SRVName name form (RFC4985), with (incomplete) Name Constraints matching rules. I don’t see any comparable effort for this hotspot-friendlyName name form. Since technically-constrained CAs is a
preferred model for enterprises (and browsers), I think it’s preferable to describe the expected behaviour of a relying party facing such combinations before blindly allowing them, even more with the « shall not be critical » describe above, which will surely
transform someday into a « I won’t implement it, it’s not critical anyway » and will bite us in the future.</div>
<div class=""><br class="">
</div>
<div class=""><br class="">
<div class="">
<div class="">Cordialement,</div>
<div class="">Erwann Abalea</div>
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">Le 3 janv. 2017 à 22:07, Jeremy Rowley via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> a écrit :</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Agreed, but this line of reasoning always leads to simply not supporting third party projects because the projects may cause issues with the CAB Forum update. IMO, if a group wants to
use publicly trusted certs, then that group inherits all the baggage that goes with it. We really control all the cards on this one as the interoperability is one-way. What would you propose to make sure we can update requirements in the future? A statement
like “CAB Forum can do whatever it wants without notice” is superfluous as this is already the case.<o:p class=""></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Jeremy<o:p class=""></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<a name="_MailEndCompose" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></a></div>
<span class=""></span>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Ryan Sleevi [<a href="mailto:sleevi@google.com" class="">mailto:sleevi@google.com</a>]<span class="Apple-converted-space"> </span><br class="">
<b class="">Sent:</b><span class="Apple-converted-space"> </span>Tuesday, January 3, 2017 1:54 PM<br class="">
<b class="">To:</b><span class="Apple-converted-space"> </span>Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" class="">jeremy.rowley@digicert.com</a>><br class="">
<b class="">Cc:</b><span class="Apple-converted-space"> </span>CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>>; Peter Bowen <<a href="mailto:pzb@amzn.com" class="">pzb@amzn.com</a>><br class="">
<b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [cabfpub] Proposed Ballot 183 - Allowing 822 Names and (limited) otherNames<o:p class=""></o:p></span></div>
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
On Tue, Jan 3, 2017 at 12:46 PM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank" style="color: purple; text-decoration: underline;" class="">jeremy.rowley@digicert.com</a>> wrote:<o:p class=""></o:p></div>
<blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;" class="">
<div class="">
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">There is a public file (in the link I provided), but it requires filling out information to access. It’s the HotSpot 2.0 Technical documentation, which includes the Certificate Policy
(“Hostspot 2-0 (R2) OSU Certificate Policy Specification”). The documentation is already free to anyone who wants to enter information and agree to the terms of use. </span><o:p class=""></o:p></div>
</div>
</div>
</blockquote>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Ah, the many meanings of free ;) I suppose it wasn't clear that I was talking more about freedom than beer there :)<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><o:p class=""></o:p></div>
</div>
<blockquote style="border-style: none none none solid; border-left-color: rgb(204, 204, 204); border-left-width: 1pt; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;" class="">
<div class="">
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">We essentially already have a liaison member from the WFA (DigiCert, Microsoft, Apple, and Google are all members).</span><o:p class=""></o:p></div>
</div>
</div>
</blockquote>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
I wouldn't put Google in that list - none of Google's CA/B Forum participants participate in HotSpot 2.0 nor communicate developments on either side of that profile to the other party. I would suggest, to date, only DigiCert does, and only to the extent you've
shared anything to the Forum.<o:p class=""></o:p></div>
</div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
<o:p class=""> </o:p></div>
</div>
<div class="">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">
Obviously, the context was that we shouldn't be introducing this to the Web PKI unless we're sure we're not going to repeat all the same mistakes we're currently going through the SHA-1 exception process - or at least trying to learn from them. It would be
foolish to ignore the feedback we've received from those affected by SHA-1 when considering expanding that scope. <o:p class=""></o:p></div>
</div>
</div>
</div>
</div>
</div>
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Public
mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""><a href="mailto:Public@cabforum.org" class="">Public@cabforum.org</a></span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class=""><a href="https://cabforum.org/mailman/listinfo/public" class="">https://cabforum.org/mailman/listinfo/public</a></span></div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>