<div dir="ltr">For CAs that are voting against this:<div><br></div><div>Given that should the Baseline Requirements fail to show consensus, the next step will be to require these changes as part of a browser program - both as to considering a certificate trusted and to considering a certificate misissued - in order to ensure security needs are met. As such, it would helpful that those voting NO provide concrete and actionable reasons as to the concerns, so as to inform what conditions that the CA might consider it acceptable. Failure to articulate concerns simply means that such concerns cannot be given any consideration before taking action.</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Feb 17, 2017 at 7:13 AM, Enric Castillo via Public <span dir="ltr"><<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">
<p>ANF Autoridad de Certificación votes no.</p>
<p><br>
</p>
<p>Thanks,<br>
</p><div><div class="h5">
<br>
<div class="m_-6075777477921784034moz-cite-prefix">El 13/02/2017 a las 14:18, Ryan Sleevi
via Public escribió:<br>
</div>
</div></div><blockquote type="cite"><div><div class="h5">
<div dir="ltr">
<div>Pursuant to the consensus on <a href="https://cabforum.org/pipermail/public/2017-February/009530.html" target="_blank">https://cabforum.org/<wbr>pipermail/public/2017-<wbr>February/009530.html</a>
about the nature of changes during the discussion period, and
the request from Gervase on <a href="https://cabforum.org/pipermail/public/2017-February/009618.html" target="_blank">https://cabforum.org/<wbr>pipermail/public/2017-<wbr>February/009618.html</a>
to adjust what represents the Baseline agreement, this adjusts
the effective date from 1 April to 24 August. While individual
programs may choose to enact or enforce requirements prior to
that, as the Baseline Requirements capture the effective point
of common agreement of the bare minimum security levels, it
seems appropriate that this Ballot accurately reflect that.</div>
<div><br>
</div>
<div><br>
</div>
<div>Ballot 185 - Limiting the Lifetime of Certificates</div>
<div><br>
</div>
<div>The following motion has been proposed by Ryan Sleevi of
Google, Inc and endorsed by Josh Aas of ISRG and Gervase
Markham of Mozilla to introduce new Final Maintenance
Guidelines for the "Baseline Requirements Certificate Policy
for the Issuance and Management of Publicly-Trusted
Certificates" and the "Guidelines for the Issuance and
Management of Extended Validation Certificates"</div>
<div><br>
</div>
<div>-- MOTION BEGINS --</div>
<div>Modify Section 6.3.2 of the "Baseline Requirements
Certificate Policy for the Issuance and Management of
Publicly-Trusted Certificates" as follows:</div>
<div><br>
</div>
<div>Replace Section 6.3.2, which reads as follows:</div>
<div>"""</div>
<div>6.3.2. Certificate Operational Periods and Key Pair Usage
Periods</div>
<div><br>
</div>
<div>Subscriber Certificates issued after the Effective Date
MUST have a Validity Period no greater than 60 months. </div>
<div>Except as provided for below, Subscriber Certificates
issued after 1 April 2015 MUST have a Validity Period </div>
<div>no greater than 39 months. </div>
<div><br>
</div>
<div>Until 30 June 2016, CAs MAY continue to issue Subscriber
Certificates with a Validity Period greater than 39 </div>
<div>months but not greater than 60 months provided that the CA
documents that the Certificate is for a system or </div>
<div>software that: </div>
<div>(a) was in use prior to the Effective Date; </div>
<div>(b) is currently in use by either the Applicant or a
substantial number of Relying Parties; </div>
<div>(c) fails to operate if the Validity Period is shorter than
60 months; </div>
<div>(d) does not contain known security risks to Relying
Parties; and </div>
<div>(e) is difficult to patch or replace without substantial
economic outlay</div>
<div>"""</div>
<div><br>
</div>
<div>with the following text:</div>
<div>"""</div>
<div>6.3.2. Certificate Operational Periods and Key Pair Usage
Periods</div>
<div><br>
</div>
<div>Subscriber Certificates issued on or after 24 August 2017
MUST NOT have a Validity Period greater than three hundred and
ninety-eight (398) days.</div>
<div><br>
</div>
<div>Subscriber Certificates issued prior to 24 August 2017 MUST
NOT have a Validity Period greater than thirty-nine (39)
months.</div>
<div>"""</div>
<div><br>
</div>
<div>Modify Section 9.4 of the "Guidelines for the Issuance and
Management of Extended Validation Certificates" as follows:</div>
<div><br>
</div>
<div>Replace Section 9.4, which reads as follows:</div>
<div>"""</div>
<div>9.4. Maximum Validity Period For EV Certificate</div>
<div><br>
</div>
<div>The validity period for an EV Certificate SHALL NOT exceed
twenty seven months. It is RECOMMENDED that EV</div>
<div>Subscriber Certificates have a maximum validity period of
twelve months.</div>
<div>"""</div>
<div><br>
</div>
<div>with the following text:</div>
<div>""""</div>
<div>9.4 Maximum Validity Period for EV Certificate</div>
<div><br>
</div>
<div>EV Certificates issued on or after 24 August 2017 MUST NOT
have a Validity Period greater than three hundred and
ninety-eight (398) days.</div>
<div><br>
</div>
<div>EV Certificates issued prior to 24 August 2017 MUST NOT
have a Validity Period greater than twenty seven (27) months.</div>
<div>"""</div>
<div>-- MOTION ENDS --</div>
<div><br>
</div>
<div>Ballot 185 - Limiting the Lifetime of Certificates</div>
<div>Status: Final Maintenance Guideline</div>
<div><br>
</div>
<div>Review Period:</div>
<div>Start Time: 2017-02-10 00:00:00 UTC</div>
<div>End Time: 2017-02-17 00:00:00 UTC</div>
<div><br>
</div>
<div>Vote for Approval:</div>
<div>Start Time: 2017-02-17 00:00:00 UTC</div>
<div>End Time: 2017-02-24 00:00:00 UTC</div>
<div><br>
</div>
<div>Votes must be cast by posting an on-list reply to this
thread on the Public Mail List.</div>
<div><br>
</div>
<div>A vote in favor of the ballot must indicate a clear 'yes'
in the response. A vote against must indicate a clear 'no' in
the response. A vote to abstain must indicate a clear
'abstain' in the response. Unclear responses will not be
counted. The latest vote received from any representative of a
voting Member before the close of the voting period will be
counted. Voting Members are listed here: <a href="https://cabforum.org/members/" target="_blank">https://cabforum.org/members/</a></div>
<div><br>
</div>
<div>In order for the ballot to be adopted, two thirds or more
of the votes cast by Members in the CA category and greater
than 50% of the votes cast by members in the browser category
must be in favor.</div>
</div>
<br>
<fieldset class="m_-6075777477921784034mimeAttachmentHeader"></fieldset>
<br>
</div></div><span class=""><pre>______________________________<wbr>_________________
Public mailing list
<a class="m_-6075777477921784034moz-txt-link-abbreviated" href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a>
<a class="m_-6075777477921784034moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/<wbr>listinfo/public</a>
</pre>
</span></blockquote>
<br>
<div class="m_-6075777477921784034moz-signature">-- <br>
<table border="0" cellpadding="5" cellspacing="0">
<tbody>
<tr>
<td> <img title="ANF AC - Autoridad de certificación" alt="ANF AC - Autoridad de certificación" src="cid:part4.6430B46B.A295E855@anf.es" width="140"> </td>
<td> <b><font style="font-family:arial" color="#1C1C1C" size="3"> Enric Castillo </font></b><br>
<font style="font-family:arial" color="#6e6e6e" size="-1"><i>
Gerente Región LATAM </i><br>
ANF Autoridad de Certificación </font> <br>
<font style="font-family:arial" color="#424242" size="-1">
<img title="Teléfono" src="cid:part5.BE71F8EF.3279D2D0@anf.es" height="15" width="15"> <a href="tel:+34%20626%2081%2082%2085" value="+34626818285" target="_blank">+34 626818285</a> <font size="-2"><i>(Celular)</i></font>
<br>
<font style="font-family:arial" color="#424242" size="-1"> <img title="Dirección" src="cid:part6.40C7A28B.4075B0AE@anf.es" height="15" width="15"> Gran Vía de Les Corts Catalanes 996,
Barcelona <br>
<font style="font-family:arial" color="#424242" size="-1"> <img title="Teléfono" src="cid:part5.BE71F8EF.3279D2D0@anf.es" height="15" width="15"> <a href="tel:+593%2099%20648%203798" value="+593996483798" target="_blank">+593 0 996483798</a> <font size="-2"><i>(Celular)</i></font> <br>
<font style="font-family:arial" color="#424242" size="-1"> <img title="Teléfono" src="cid:part5.BE71F8EF.3279D2D0@anf.es" height="15" width="15"> <a href="tel:+593%202-255-0002" value="+59322550002" target="_blank">+593 2 2550002</a>
<br>
<font style="font-family:arial" color="#424242" size="-1"> <img title="Dirección" src="cid:part6.40C7A28B.4075B0AE@anf.es" height="15" width="15"> Av. 12 de Octubre
N24-562 y Luis Cordero, Edif. World Trade
Center, Torre A, Piso 11, Ofi. 1102, Quito <br>
<font style="font-family:arial" size="-1"> <img title="Dirección de Skype" src="cid:part10.26602E0B.43A52999@anf.es" height="15" width="15"> castillo.enric </font>
<br>
<font style="font-family:arial" size="-1"> <img title="Dirección de correo electrónico" src="cid:part11.659013B3.002BD72D@anf.es" height="15" width="15">
<a class="m_-6075777477921784034moz-txt-link-abbreviated" href="mailto:enric.castillo@anf.es" target="_blank">enric.castillo@anf.es</a> </font> <br>
<font style="font-family:arial" size="-1"> <img title="Dirección Web" src="cid:part12.C4659155.B16A2AEE@anf.es" height="15" width="15"> <a class="m_-6075777477921784034moz-txt-link-abbreviated" href="http://www.anf.es" target="_blank">www.anf.es</a> </font>
</font></font></font></font></font></td>
</tr>
<tr>
<td><br>
</td>
<td align="left"> <img src="cid:part13.87320EEE.D8AABEA2@anf.es" width="215"> </td>
</tr>
</tbody>
</table>
<font style="font-family:arial" color="#666666" size="-2"> <b>AVISO</b><br>
</font> <font style="font-family:arial" color="#666666" size="1">
Este mensaje se dirige exclusivamente a su destinatario y puede
contener información privilegiada o confidencial y/o datos de
carácter personal, cuya difusión está regulada por la Ley
Orgánica de Protección de Datos y la Ley de Servicios de la
Sociedad de la Información. Si usted no es el destinatario
indicado (o el responsable de la entrega al mismo), no debe
copiar o entregar este mensaje a terceros bajo ningún concepto.
Si ha recibido este mensaje por error o lo ha conseguido por
otros medios, le rogamos que nos lo comunique inmediatamente por
esta misma vía y proceda a su eliminación irreversible. Las
opiniones, conclusiones y demás informaciones incluidas en este
mensaje que no estén relacionadas con asuntos profesionales de
ANF Autoridad de Certificación no están respaldadas por la
empresa. </font> </div>
</div>
<br>______________________________<wbr>_________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" rel="noreferrer" target="_blank">https://cabforum.org/mailman/<wbr>listinfo/public</a><br>
<br></blockquote></div><br></div>