<div dir="ltr">While I'm encouraged to see that CAs are beginning to recognize the shorter lived certificates, I'm concerned that this introduces significantly more changes than discussed during any Forum discussion over the past several years.<div><br></div><div>I'd like to encourage the proposers to thoughtfully consider whether this is either necessary or desirable, as there are clear problems with this proposal.</div><div><br></div><div class="gmail_extra"><div class="gmail_quote">On Wed, Mar 1, 2017 at 2:14 PM, Chris Bailey via Public <span dir="ltr"><<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="m_-1745840960682079190WordSection1">
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">Section 6.3.2 limits the validity period of Subscriber Certificates. The CA MAY use the documents and data provided in Section 3.2 to verify certificate information, provided that
<b><u>(i)</u></b> the CA obtained the data or document from a source specified under Section 3.2 no more than
<b><u>825 days</u> </b><i><s>thirty‐nine (39) months</s></i> prior to issuing the Certificate<b><u>; and (ii) the method used to obtain the document or data was acceptable under Section 3.2 at the time the document or data was obtained</u></b>.<br></p></div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72"><div class="m_-1745840960682079190WordSection1"><p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none"><u></u></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<b><u>A CA may rely on a previously verified certificate request to issue a replacement certificate, so long as the certificate being referenced was not revoked due to fraud or other illegal conduct, if:</u></b></p></div></div></blockquote><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72"><div class="m_-1745840960682079190WordSection1"><p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal"><u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<b><u>(1) The expiration date of the replacement certificate is the same as the expiration date of the Certificate that is being replaced, and</u></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<b><u>(2) The Subject Information of the Certificate is the same as the Subject in the Certificate that is being replaced.</u></b><u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<b> </b><u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<b><u>If an Applicant has a currently valid Certificate issued by the CA, a CA MAY rely on its prior authentication and verification of the Applicant's right to use the specified Domain Name under Section 3.2.2.4, provided that the CA verifies that the WHOIS
record still shows the same registrant as when the CA verified the specified Domain Name for the existing Certificate.</u></b></p></div></div></blockquote><div><br></div><div>Can you explain why you believe this change is necessary or critical? It represents a significant departure from best practice, in a way that will undermine security of the ecosystem.</div><div><br></div><div>Our position with respect to Draft Ballot 186 should hopefully make it clear that any attempt to extend the reuse of stale information, a very real and pressing security problem, makes such an approach problematic.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="white" lang="EN-US" link="#0563C1" vlink="#954F72"><div class="m_-1745840960682079190WordSection1"><p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none"><u></u><u></u></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">Subscriber Certificates issued after <b><u>March 1, 2018 </u></b><i><s>the Effective Date</s></i> MUST have a Validity Period no greater than
<b><u>825 days</u> </b><i><s>60 months</s></i>. <b><u>Subscriber Certificates issued after 1 April 2015 but prior to 1 March 2018 MUST NOT have a Validity Period greater than thirty-nine (39) months.</u></b></p></div></div></blockquote><div><br></div><div>It's unnecessary to state "after 1 April 2015". Given that the Baseline Requirements are effective at time of issuance, this is a redundancy that may impinge on clarity.</div><div> </div></div><br></div></div>