<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On May 1, 2017, at 11:41 AM, Doug Beattie <<a href="mailto:doug.beattie@globalsign.com" class="">doug.beattie@globalsign.com</a>> wrote:</div><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">I understand how NC values for domain names relate to CA certificates that have ServerAuth or Secure email, but I’m not sure about Code Signing, client auth, document signing and time stamping. <span class="Apple-converted-space"> </span><o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><span class="">-<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Is the list of required DN fields listed anywhere for these types to be considered to be Name Constrained? Could I NC an OU field and call it name constrained if that is all I wanted in the subject of the issued certificates?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: 'Courier New'; color: rgb(31, 73, 125);" class=""><span class="">o<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">NC in RFC5280 decomposes to:<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: Wingdings; color: rgb(31, 73, 125);" class=""><span class="">§<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">GeneralSubtrees, then to<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: Wingdings; color: rgb(31, 73, 125);" class=""><span class="">§<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">GeneralName then to<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 1.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: Wingdings; color: rgb(31, 73, 125);" class=""><span class="">§<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">a choice of rfc822Name, dNSName, directoryName (Name), and more<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: 'Courier New'; color: rgb(31, 73, 125);" class=""><span class="">o<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">If we NC by Name (decomposes to RelativeDistinguishedName), what specific AttributeTypes are needed? Perhaps some of the cert types have rules about what MUST go into their DN, but that’s not the case for all of them (e.g., client auth).<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 1in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: 'Courier New'; color: rgb(31, 73, 125);" class=""><span class="">o<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">So, what constitutes NC in those cases? Is NC meaningful?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; text-indent: -0.25in;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><span class="">-<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class="">Side question: Do any of “these” applications enforce name constraints? If not, what’s the point (other than not being required to perform WT audits, which doesn’t bother me a bit…just asking)<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a name="_MailEndCompose" class="" style="font-size: 12pt;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""></span></a></div></div></div></blockquote><div><br class=""></div><div>Doug,</div><div><br class=""></div><div>To be honest, I don’t really know. I was trying to follow the Mozilla and Microsoft policies (and the implied Chrome policy) when building the flow chart. That is why the EKU split; Chrome only seems to care about serverAuth, so that is one path. Mozilla also cares about emailProtection, so that is another path. And then Microsoft’s requirements list a number of EKUs as requiring audits, so that is the last path.</div><div><br class=""></div><div>Microsoft’s definitions say constrained has "EKU, geographic, or other technical restrictions”. The EKU part is relatively easy — but I did forget to include that bit in the flow chart. If you take it literally, then you are right, you could have a constraint on OU and call it good. Maybe Jody or Keri can clarify their intent for these EKUs.</div><div><br class=""></div><div>I suspect that many applications enforce name constraints because they use the Microsoft library when running on Windows. </div><div><br class=""></div><div>Thanks,</div><div>Peter</div><div><br class=""></div><br class=""><blockquote type="cite" class=""><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><a name="_MailEndCompose" class="" style="font-size: 12pt;"><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);" class=""><o:p class=""> </o:p></span></a></div><div style="border-style: none none none solid; border-left-width: 1.5pt; border-left-color: blue; padding: 0in 0in 0in 4pt;" class=""><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span class="Apple-converted-space"> </span>Public [<a href="mailto:public-bounces@cabforum.org" style="color: purple; text-decoration: underline;" class="">mailto:public-bounces@cabforum.org</a>]<span class="Apple-converted-space"> </span><b class="">On Behalf Of<span class="Apple-converted-space"> </span></b>Peter Bowen via Public<br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Sunday, April 30, 2017 1:26 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" style="color: purple; text-decoration: underline;" class="">jeremy.rowley@digicert.com</a>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline;" class="">public@cabforum.org</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Peter Bowen <<a href="mailto:pzb@amzn.com" style="color: purple; text-decoration: underline;" class="">pzb@amzn.com</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [cabfpub] Which CAs must be audited<o:p class=""></o:p></span></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Of course I missed a key step. If there is an EKU extension, check to see if it contains the anyEKU KP. If so, then go to the pathLen check. Otherwise check for specific KPs.<o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">On Apr 30, 2017, at 9:27 AM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" style="color: purple; text-decoration: underline;" class="">jeremy.rowley@digicert.com</a>> wrote:<o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Lol at the IPv4 and IPv6 part.</span><o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span><o:p class=""></o:p></div></div><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0in 0in;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><b class=""><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">From:</span></b><span class="apple-converted-space"><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class=""> </span></span><span style="font-size: 11pt; font-family: Calibri, sans-serif;" class="">Public [<a href="mailto:public-bounces@cabforum.org" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">mailto:public-bounces@cabforum.org</span></a>]<span class="apple-converted-space"> </span><b class="">On Behalf Of<span class="apple-converted-space"> </span></b>Peter Bowen via Public<br class=""><b class="">Sent:</b><span class="apple-converted-space"> </span>Sunday, April 30, 2017 8:53 AM<br class=""><b class="">To:</b><span class="apple-converted-space"> </span>CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">public@cabforum.org</span></a>><br class=""><b class="">Cc:</b><span class="apple-converted-space"> </span>Peter Bowen <<a href="mailto:pzb@amzn.com" style="color: purple; text-decoration: underline;" class=""><span style="color: rgb(149, 79, 114);" class="">pzb@amzn.com</span></a>><br class=""><b class="">Subject:</b><span class="apple-converted-space"> </span>[cabfpub] Which CAs must be audited</span><o:p class=""></o:p></div></div></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Over on the mozilla.dev.security.policy list, there was some confusion about which subordinate CAs need to have audits.<o:p class=""></o:p></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">I’ve put together two flow charts to help document what I think has been said on that list. I tried to merge info from both the Mozilla and Microsoft policies, so I might be a little off.<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">The one place where this does differ from current Mozilla policy is that it has disclosure of technically constrained CA certificates themselves. This is proposed for Mozilla but not yet required.<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Anyone see errors?<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Thanks,<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class="">Peter<o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><image001.png><o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""> <o:p class=""></o:p></div></div></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif;" class=""><image002.jpg></div></div></div></div></blockquote></div></div></div></div></blockquote></div><br class=""></body></html>