<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:13.5pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Calibri Light",sans-serif;
color:#1F4D78;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Yes, I know there was a reason given. All I can tell you, Peter, is we have a number of customers in the United Kingdom who very much dislike the fact that their
certs say “GB” – they consider it incorrect, and have called us on it from time to time. But I guess they are stuck with it unless they successfully petition ISO for a change. From what Dimitris has said, there may be a conflict between what the Greek government
thinks the country code should be, and what ISO decided some time ago – in general, I think a country should be able to decide that for itself.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Standards are important, but it’s my recollection that some browsers have chosen to deviate from standards including IETF standards, even RFC 5280, from time
to time for what they believed was a good reason (instead of trying to change the standard). We should be consistent on our approach.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Peter Bowen [mailto:pzb@amzn.com]
<br>
<b>Sent:</b> Friday, March 17, 2017 4:58 PM<br>
<b>To:</b> CA/Browser Forum Public Discussion List <public@cabforum.org><br>
<b>Cc:</b> Dimitris Zacharopoulos <jimmy@it.auth.gr>; Kirk Hall <Kirk.Hall@entrustdatacard.com><br>
<b>Subject:</b> Re: [cabfpub] C=GR, C=UK exceptions in BRs<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Kirk,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">ISO 3166 was apparently created in 1974 to provide a distinct two letter code for each country. From their own FAQ (<a href="https://web.archive.org/web/20120616044022/http:/www.iso.org/iso/country_codes/iso_3166-faqs/iso_3166_faqs_specific.htm">https://web.archive.org/web/20120616044022/http://www.iso.org/iso/country_codes/iso_3166-faqs/iso_3166_faqs_specific.htm</a>):<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<h3 style="mso-margin-top-alt:0in;margin-right:12.0pt;margin-bottom:12.0pt;margin-left:12.0pt;line-height:15.6pt;background:#DDE0EE;font-variant-ligatures: normal;orphans: 2;widows: 2">
<span style="font-size:14.5pt;font-family:"Arial",sans-serif;color:#333355">Why is the United Kingdom (of Great Britain and Northern Ireland) coded GB in ISO 3166-1?<o:p></o:p></span></h3>
<div style="margin-left:.25in;margin-right:.25in;margin-bottom:12.0pt;font-variant-ligatures: normal;orphans: 2;widows: 2">
<p class="MsoNormal" style="line-height:15.6pt"><span style="font-size:14.5pt;font-family:"Arial",sans-serif;color:#333355"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:.25in;margin-bottom:12.0pt;margin-left:.25in;line-height:15.6pt;font-variant-ligatures: normal;orphans: 2;widows: 2">
<span style="font-size:14.5pt;font-family:"Arial",sans-serif;color:#333355">The codes in ISO 3166-1 are - wherever possible - chosen to reflect the significant, unique component of the country name in order to allow a visual association between country name
and country code. Since name components like <em><span style="font-family:"Arial",sans-serif">Republic</span></em>, <em><span style="font-family:"Arial",sans-serif">Kingdom</span></em>, <em><span style="font-family:"Arial",sans-serif">United</span></em>, <em><span style="font-family:"Arial",sans-serif">Federal </span></em>or <em><span style="font-family:"Arial",sans-serif">Democratic </span></em>are
used very often in country names we usually do not derive the country code elements from them in order to avoid ambiguity. The name components <em><span style="font-family:"Arial",sans-serif">United </span></em>and <em><span style="font-family:"Arial",sans-serif">Kingdom</span></em> are
not appropriate for ISO 3166-1. Therefore the code "GB" was created from Great Britain and not "UK" for United Kingdom. Incidently, GB is also the United Kingdom's <em><span style="font-family:"Arial",sans-serif">international road vehicle distinguishing sign</span></em> -
the code on the oval nationality stickers on cars.<o:p></o:p></span></p>
<div>
<p class="MsoNormal">Given that neither the EU or Greece has requested EL to be reserved for any purpose (<a href="https://www.iso.org/obp/ui/#iso:code:3166:EL">https://www.iso.org/obp/ui/#iso:code:3166:EL</a>) I don’t believe it makes sense to use this in
the country code field.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Peter<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Mar 17, 2017, at 3:55 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org">public@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Ryan makes a good point – where there is a conflict between local law or practice (or desired practice) and the BRs, the best first step is to amend the BRs to
allow compliance with local law or practice (or desired practice).</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">As I recall the country codes we are all stuck with were created in the 1960s for a purpose unrelated to SSL and digital certificates. There must have been a
good reason for representing the United Kingdom (England, Wales, Scotland (for now), and Northern Ireland) as “GB” when Northern Island (part of the UK) is not in Great Britain and UK is the more generally known acronym for the United Kingdom – but I can’t
imagine what the good reason was.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Instead of a ballot that presents a sweeping new structure for country names, or points to another new document, maybe we just create an Appendix to the BRs that
allows different country codes for Greece and the United Kingdom (as an alternative). We would endorse such a ballot.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> </span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Public [<a href="mailto:public-bounces@cabforum.org">mailto:public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Ryan Sleevi via Public<br>
<b>Sent:</b> Friday, March 17, 2017 1:12 PM<br>
<b>To:</b> Dimitris Zacharopoulos <<a href="mailto:jimmy@it.auth.gr">jimmy@it.auth.gr</a>><br>
<b>Cc:</b> Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br>
<b>Subject:</b> Re: [cabfpub] C=GR, C=UK exceptions in BRs</span><o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
<div>
<p class="MsoNormal">On Fri, Mar 17, 2017 at 4:08 PM, Ryan Sleevi <<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal">On Fri, Mar 17, 2017 at 3:01 PM, Dimitris Zacharopoulos <<a href="mailto:jimmy@it.auth.gr" target="_blank">jimmy@it.auth.gr</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">The "spirit" of 9.16.3 is also to bring conflicting requirements to the CA/B Forum to consider possible revisions accordingly. This is exactly what I am doing, without violating the current BRs, but hoping that the CA/B Forum will read
this as a conflicting requirement which could be resolved by adding a simple exception, without creating any risk in current practices.<o:p></o:p></p>
</div>
</blockquote>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">For what it's worth - I agree with this sentiment, and it's worth considering, separate of 9.16.3, whether to _revise_ the BRs to accomodate this case. Such revisions must account for ambiguity. In many ways, the BRs strive to eliminate
the rampant ambiguity that existed due to CAs' various practices, as a whole (since no two CAs really have the same CP/CPS), and so we should strive, as much as possible, to unambiguously represent the information that members see as valuable.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Of course, it might be that identity information in certificates is not valuable, precisely because of ambiguities and conflicts that naturally emerge from CAs. In that case, it might be worthwhile to simply stop trying to represent identity
information within certificates, and accept that ambiguity, rather than try to carve it up. However, since the Forum values identity information at present, it makes sense to opt for strictness as much as possible, or to explicitly describe the deviations
permitted and assess their risk, as you propose doing and is worth at least discussing :) <o:p></o:p></p>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>