<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><br class=""></div><div class="">Kirk,</div><div class=""><br class=""></div><div class="">I’m glad to hear you support my proposal. I did realize, after reading Ryan’s email, the sunset probably needs to be a rolling date to handle the BR “phase in” period. So the rule needs to effectively be:</div><div class=""><br class=""></div><div class="">* Effective July 1, 2017, unexpired OV/IV SSL certificates must be revoked within 24 hours of the fifth anniversary of their issuance</div><div class=""><br class=""></div><div class="">The details need to get ironed out (define fifth anniversary, etc), but I think that this ensure that, by mid-2018, all SSL certs that have organization or individual identity used at least baseline vetting requirements.</div><div class=""><br class=""></div><div class="">Thanks,</div><div class="">Peter</div><div class=""><br class=""></div><br class=""><div><blockquote type="cite" class=""><div class="">On Feb 24, 2017, at 10:06 PM, Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" class="">Kirk.Hall@entrustdatacard.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">+1 Peter. Well said. <span class="Apple-converted-space"> </span></div></div></div></blockquote><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">All the CA Security Council (CASC) members have endorsed the following Five Principles of TLS Certificate Identity </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">1. Identity in TLS server certs should be used by browsers as a proxy for greater user safety<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">2. CAs should vet their customers to the highest identity level possible<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">3. OV certs should receive their own browser UI different from DV certs to show user safety<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">4. EV certs should continue to receive a separate browser UI from OV and DV certs to show greater user safety<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">5. Browsers should agree on common UI security indicators, avoid changes to UI, and work with others to educate users about the meaning of the common UI security indicators for greater user safety.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""> </span></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">We had not planned to bring this up in the Forum (and there is no need to discuss further on this list), <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">As to the main suggestion in Peter’s email – we support this. If there are pre-BR certs still out there that are not in compliance with the BRs (after five years), let’s get them revoked. It will be easy to do, and good for user security.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">-----Original Message-----<br class="">From: Public [<a href="mailto:public-bounces@cabforum.org" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">mailto:public-bounces@cabforum.org</a>] On Behalf Of Peter Bowen via Public<br class="">Sent: Friday, February 24, 2017 8:40 PM<br class="">To: CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">public@cabforum.org</a>><br class="">Cc: Peter Bowen <<a href="mailto:pzb@amzn.com" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">pzb@amzn.com</a>><br class="">Subject: [cabfpub] Assuring trust in website identities</div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The BRs came into effect on July 1, 2012. This year we have the fifth anniversary of the BRs, and we have an opportunity to help provide high assurance of website identities using certificates. Given the new Website Identity initiative (<a href="https://casecurity.org/identity/" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="color: windowtext; text-decoration: none;" class="">https://casecurity.org/identity/</span></a>) announced at RSAC last week (<a href="https://www.rsaconference.com/videos/100-encrypted-web-new-challenges-for-tls" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="color: windowtext; text-decoration: none;" class="">https://www.rsaconference.com/videos/100-encrypted-web-new-challenges-for-tls</span></a>), it is clear others are thinking similarily.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">In a discussion with Kirk today, I mentioned that one of the challenges with recognition of OV certificates is the existence of certificates with OV/IV info which are not covered by the BRs, either due to issuance date or missing data in the certificate. It is very hard for browsers to detect whether a certificate is a legitimate OV/IV certificate or not given the existence of these certificates. In order to help assure trust in website identity, Kirk suggested that we set a sunset date for certificates with identity that are not clearly covered in the BRs.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I think the sunset date should be July 1, 2017, which is five years from the BR effective date. On this date, all CAs much revoke unexpired certificates that meet the following criteria:<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">- Contain at least one attribute of type organizationName {2 5 4 10}, givenName {2 5 4 42}, or surName {2 5 4 4} in the Subject Name, and<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">- Is not self-signed certificate, as defined in X.509, and does not have cA set to true in the basic constraints extension (this avoids revoking CA certificates), and<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">- Any of the following are true:<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> - Is not a valid Certificate as defined by X.509<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> - Was issued before 2012-07-01T00:00:00Z and includes an extended key usage extension that contains the id-kp-serverAuth {1 3 6 1 5 5 7 3 1} or anyExtendedKeyUsage {2 5 29 37 0} key purpose<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> - Does not include an extended key usage extension but does include a key usage extension with digitalSignature<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> - Does not include an extended key usage extension but does include a key usage extension with keyEncipherment and has a RSA subject public key<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">By revoking these certificates, we can assure that all un-revoked certificates used for website identity authentication that have identity information were vetted according to the BRs.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I want to thank Kirk for suggesting revocation of these as the solution to help assure relying parties of website identities.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Do others agree that this path makes sense in order to provide high assurance of website identity?<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Thanks,<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Peter<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">_______________________________________________<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Public mailing list<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><a href="mailto:Public@cabforum.org" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="color: windowtext; text-decoration: none;" class="">Public@cabforum.org</span></a><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><a href="https://cabforum.org/mailman/listinfo/public" style="color: rgb(149, 79, 114); text-decoration: underline;" class=""><span style="color: windowtext; text-decoration: none;" class="">https://cabforum.org/mailman/listinfo/public</span></a><o:p class=""></o:p></div></div><span id="cid:153FFBF9-6FAE-4DB5-A189-B48746DCFE39@amazon.com"><RSAC 2017 PDAC W10 Hall presentation (2-10-2017).pdf></span></blockquote></div><br class=""></body></html>