<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Mar 17, 2017 at 1:51 PM, Rick Andrews <span dir="ltr"><<a href="mailto:Rick_Andrews@symantec.com" target="_blank">Rick_Andrews@symantec.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div class="m_8575751454593018495WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#44546a"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#44546a"><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]
<br>
<b>Sent:</b> Friday, March 17, 2017 10:42 AM<span class=""><br>
<b>To:</b> Rick Andrews <<a href="mailto:Rick_Andrews@symantec.com" target="_blank">Rick_Andrews@symantec.com</a>><br>
<b>Cc:</b> CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>>; Gervase Markham <<a href="mailto:gerv@mozilla.org" target="_blank">gerv@mozilla.org</a>><br>
<b>Subject:</b> Re: [cabfpub] Results on Ballot 187 - Make CAA Checking Mandatory<u></u><u></u></span></span></p>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
<div>
<p class="MsoNormal" style="margin-left:.5in">On Fri, Mar 17, 2017 at 1:34 PM, Rick Andrews <<a href="mailto:Rick_Andrews@symantec.com" target="_blank">Rick_Andrews@symantec.com</a>> wrote:<u></u><u></u></p><span class="">
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-left:.5in">If the issue or issuewild records indicate that I am permitted to issue the cert, it seems excessive to reject because I can't parse the iodef record. As a permitted CA, I don't need to do anything with the iodef
record.<u></u><u></u></p>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
</span><div><span class="">
<p class="MsoNormal" style="margin-left:.5in">That's not correct. For example, imagine the issue indicates Symantec, but it requests EV only (via a Symantec-defined issuer-parameter), and you receive a request a DV. What do you do then?<u></u><u></u></p>
</span><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#44546a">Symantec has not defined any additional parameters, so this question is moot (for me).</span></p></div></div></div></div></div></div></blockquote><div><br></div><div>But it's not moot for relying parties or for browsers, as your interpretation effectively prevents any assurance of issuer-parameters from being useful and deployed, even if you do not wish to do so.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple"><div class="m_8575751454593018495WordSection1"><div><div><div><div><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#44546a"><u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
<div><span class="">
<p class="MsoNormal" style="margin-left:.5in">Similarly, if the Forum introduces issuer-parameters regarding the use of 3.2.2.4 validity methods, what then?<u></u><u></u></p>
</span><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#44546a">The Forum has not defined any parameters yet, so this question is moot.<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#44546a"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#44546a">For this simple case where there are no additional parameters and I find my identifier in an issue or issuewild record, I need not even view an iodef record.<u></u><u></u></span></p><span class="">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#44546a"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#44546a">How do others interpret it?<u></u><u></u></span></p>
</span></div><span class="">
<div>
<p class="MsoNormal" style="margin-left:.5in"> <u></u><u></u></p>
</div>
<blockquote style="border:none;border-left:solid #cccccc 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-left:.5in"><br>
Your intent is probably to catch the error and alert the domain owner, so that they can fix it in case a non-authorized CA tries to issue a cert for the domain. While I can see the advantage of that, I'm not sure that this action was intended by the RFC or
Gerv's ballot.<br>
<br>
How do others interpret it?<br>
<br>
-Rick<br>
<br>
From: Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]<br>
Sent: Friday, March 17, 2017 10:26 AM<br>
To: Rick Andrews <<a href="mailto:Rick_Andrews@symantec.com" target="_blank">Rick_Andrews@symantec.com</a>><br>
Cc: CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>>; Gervase Markham <<a href="mailto:gerv@mozilla.org" target="_blank">gerv@mozilla.org</a>><u></u><u></u></p>
<div>
<div>
<p class="MsoNormal" style="margin-right:0in;margin-bottom:12.0pt;margin-left:.5in">
Subject: Re: [cabfpub] Results on Ballot 187 - Make CAA Checking Mandatory<br>
<br>
Fail to issue.<br>
<br>
On Fri, Mar 17, 2017 at 1:25 PM, Rick Andrews <<a href="mailto:Rick_Andrews@symantec.com" target="_blank">Rick_Andrews@symantec.com</a>> wrote:<br>
But what am I supposed to do if I can’t parse the syntax?<br>
<br>
From: Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]<br>
Sent: Friday, March 17, 2017 10:22 AM<br>
To: CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>
Cc: Gervase Markham <<a href="mailto:gerv@mozilla.org" target="_blank">gerv@mozilla.org</a>>; Rick Andrews <<a href="mailto:Rick_Andrews@symantec.com" target="_blank">Rick_Andrews@symantec.com</a>><br>
Subject: Re: [cabfpub] Results on Ballot 187 - Make CAA Checking Mandatory<br>
<br>
<br>
<br>
On Fri, Mar 17, 2017 at 1:18 PM, Rick Andrews via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<br>
Gerv, I would suggest simply removing "iodef" from "CAs MUST process the issue, issuewild, and iodef property tags". To me, the word "process" means to take some kind of action, as we must do with issue and issuewild tags. From what others have said, if the
iodef record isn't marked critical, I can ignore it, and if it is marked critical, I can ignore it as long as I recognize it as an iodef record. I wouldn't call that "processing" the record.<br>
<br>
That's not quite correct. If it's marked critical, you must still understand how to parse the syntax, and ensure it is something you actively understand, even if you do not report.<u></u><u></u></p>
</div>
</div>
</blockquote>
</span></div>
<p class="MsoNormal" style="margin-left:.5in"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
</blockquote></div><br></div></div>