<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">Kirk,</div><div class=""><br class=""></div><div class="">I think we already address the issue you raise in our existing bylaws. We allow two different alternative qualifications for a CA member:</div><div class=""><br class=""></div><div style="orphans: 2; widows: 2;" class="">1) Root CA: WebTrust or ETSI audit and "<span style="color: rgb(51, 51, 51); font-family: 'Droid Sans', Arial, Verdana, sans-serif; font-size: 13px; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">actively issues certificates to subordinate CAs that, in turn, actively issue certificates to Web servers that are openly accessible from the Internet using a browser created by a Browser member</span><font color="#333333" face="Droid Sans, Arial, Verdana, sans-serif" size="2" class="">”</font></div><div class=""><span style="color: rgb(51, 51, 51); font-family: 'Droid Sans', Arial, Verdana, sans-serif; font-size: 13px; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class=""><br class=""></span></div><div class=""><span style="color: rgb(51, 51, 51); font-family: 'Droid Sans', Arial, Verdana, sans-serif; font-size: 13px; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">2) Issuing CA: WebTrust or ETSI audit and "</span><span style="color: rgb(51, 51, 51); font-family: 'Droid Sans', Arial, Verdana, sans-serif; font-size: 13px; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);" class="">actively issues certificates to Web servers that are openly accessible from the Internet using a browser created by a Browser member</span><font color="#333333" face="Droid Sans, Arial, Verdana, sans-serif" size="2" class="">”</font></div><div class=""><br class=""></div><div style="orphans: 2; widows: 2;" class=""><font color="#333333" face="Droid Sans, Arial, Verdana, sans-serif" size="2" class=""><span style="background-color: rgb(255, 255, 255);" class="">Anyone who (a) has a period of time audit report and (b) has a CA that is either included in a Browser trust store or is cross-signed by a CA that is a root CA or issuing CA would appear to be eligible for membership today.</span></font></div><div style="orphans: 2; widows: 2;" class=""><font color="#333333" face="Droid Sans, Arial, Verdana, sans-serif" size="2" class=""><span style="background-color: rgb(255, 255, 255);" class=""><br class=""></span></font></div><div style="orphans: 2; widows: 2;" class=""><font color="#333333" face="Droid Sans, Arial, Verdana, sans-serif" size="2" class=""><span style="background-color: rgb(255, 255, 255);" class="">Thanks,</span></font></div><div style="orphans: 2; widows: 2;" class=""><font color="#333333" face="Droid Sans, Arial, Verdana, sans-serif" size="2" class=""><span style="background-color: rgb(255, 255, 255);" class="">Peter</span></font></div><br class=""><div><blockquote type="cite" class=""><div class="">On Apr 11, 2017, at 4:36 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">No – more like the situation with the root that Google bought from GlobalSign, but leaving an issuing subroot with GlobalSign for it to use. (If I understand the situation correctly.) I don’t think that involved Delegated Third Parties – there are two independent CAs operating under one trusted root with multiple issuing subroots controlled by two different companies.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I’m pretty sure there have been other situations where a new CA got a branded, issuing subroot from another CA, sometimes for a limited time while the new CA generated its own roots and submitted them to the browsers – but I can’t remember exact details.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Bear in mind we are ONLY talking about CABF membership rules under our Bylaws, not the BRs or issues such as audit rules, RAS/DTPs etc. So let’s keep it simple. I think we should encourage the widest possible membership as a way of increasing communication and participating by CAs. If two CA members are "affiliated", then our Bylaws limit them to one vote, but otherwise the two CAs can continue to participate as members.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Today our membership rules are silent on owning/controlling roots and subroots, so a CA that only has the right to use a subroot from another CAs root qualifies for Forum membership (so long as that CA is issuing certs and has the necessary audit).<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><u class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Gerv</span></u><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><span class="Apple-converted-space"> </span>– as you recall, we don’t have a definition of “affiliate” in the Bylaws – maybe your ballot should add a definition taken from our IPR Policy agreement.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Ryan Sleevi [<a href="mailto:sleevi@google.com" style="color: purple; text-decoration: underline;" class="">mailto:sleevi@google.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Tuesday, April 11, 2017 4:13 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" style="color: purple; text-decoration: underline;" class="">Kirk.Hall@entrustdatacard.com</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline;" class="">public@cabforum.org</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [cabfpub] [EXTERNAL] Bylaw interpretation: root store membership required?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">There are specific terms in the Baseline Requirements that describe various relationships, and I'm not sure how to map what you describe on to them. It appears to be related to the Delegated Third Party discussion, and you're suggesting Delegated Third Parties - even if nominally called CAs - should not be able to vote/participate. Is that correct?<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Tue, Apr 11, 2017 at 7:07 PM, Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank" style="color: purple; text-decoration: underline;" class="">Kirk.Hall@entrustdatacard.com</a>> wrote:<o:p class=""></o:p></div><blockquote style="border-style: none none none solid; border-left-width: 1pt; border-left-color: rgb(204, 204, 204); padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;" class=""><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Renting was a short hand way of saying some members may not own a trusted root. They may have the contractual right to use an issuing subroot of a trusted root owned by another CA – whether they are hosting the issuing subroot themselves or the issuing subroot is hosted for them by the CA that owns the root, or by others. </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Whether or not they “own” the issuing subroot, or just have a limited ability to use the subroot for a limited time (hence, “rent”) may vary from case to case.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">That’s the language we need to work on if we want to amend the Bylaws on qualifications for CA members.</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank" style="color: purple; text-decoration: underline;" class="">sleevi@google.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Tuesday, April 11, 2017 9:38 AM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank" style="color: purple; text-decoration: underline;" class="">public@cabforum.org</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank" style="color: purple; text-decoration: underline;" class="">Kirk.Hall@entrustdatacard.com</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [cabfpub] [EXTERNAL] Bylaw interpretation: root store membership required?</span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Can you describe what "renting" a root entails? How is it objectively quantified as distinct from "own or control"?<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I would presume, for example, that anyone "renting" a root (the first time I have heard of such claim) would be able to demonstrate "control" for the duration of the rental, much as I would be able to demonstrate control of a vehicle that I was renting and driving.<o:p class=""></o:p></div></div></div></div></div></blockquote></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div></div></div><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Public mailing list</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="mailto:Public@cabforum.org" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">Public@cabforum.org</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="https://cabforum.org/mailman/listinfo/public" style="color: purple; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://cabforum.org/mailman/listinfo/public</a></div></blockquote></div><br class=""></body></html>