<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.im
{mso-style-name:im;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>Should we include the domain name in that sequence so it’s not ordered? <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>Such as: <o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal>BRComplianceDetails ::= SEQUENCE {<o:p></o:p></p><p class=MsoNormal> dNSName IA5String,<o:p></o:p></p><p class=MsoNormal> version OBJECT IDENTIFIER,<o:p></o:p></p><p class=MsoNormal> validationMethod INTEGER<o:p></o:p></p><p class=MsoNormal>}<o:p></o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </o:p></span></a></p><span style='mso-bookmark:_MailEndCompose'></span><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> Ryan Sleevi [mailto:sleevi@google.com] <br><b>Sent:</b> Monday, May 1, 2017 9:18 AM<br><b>To:</b> Jeremy Rowley <jeremy.rowley@digicert.com><br><b>Cc:</b> CA/Browser Forum Public Discussion List <public@cabforum.org>; Gervase Markham <gerv@mozilla.org><br><b>Subject:</b> Re: [cabfpub] Ballot 190<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>Well, I was discussing in the broader context :)<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>For example, you "could" simply indicate<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>BRComplianceDetails ::= SEQUENCE {<o:p></o:p></p></div><div><p class=MsoNormal> version OBJECT IDENTIFIER,<o:p></o:p></p></div><div><p class=MsoNormal> validationMethod INTEGER<o:p></o:p></p></div><div><p class=MsoNormal>}<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>As an extension<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>There are, of course, more efficient ways to structure this data (for example, expandable enum of INTEGER values for version). I just provided this as a quick and dirty example of how you could provide this information within a certificate in a clear and auditable way. It could allow, for example, auditors to ensure that their random sampling methodology appropriately covered all validation methods the CA practiced, without undermining the purpose and value of sampling.<o:p></o:p></p></div></div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On Mon, May 1, 2017 at 11:13 AM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal style='margin-bottom:12.0pt'>How does this work if the intermediate doesn't contain the anyPolicy OID?<br><br><span class=im>-----Original Message-----</span><br><span class=im>From: Public [mailto:<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>] On Behalf Of Gervase</span><br><span class=im>Markham via Public</span><br><span class=im>Sent: Monday, May 1, 2017 9:08 AM</span><br><span class=im>To: Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a>>; CA/Browser Forum Public Discussion List</span><br><span class=im><<a href="mailto:public@cabforum.org">public@cabforum.org</a>></span><br><span class=im>Cc: Gervase Markham <<a href="mailto:gerv@mozilla.org">gerv@mozilla.org</a>></span><br><span class=im>Subject: Re: [cabfpub] Ballot 190</span><o:p></o:p></p><div><div><p class=MsoNormal>On 01/05/17 16:02, Ryan Sleevi wrote:<br>> I did. It allows users to make an informed decision of the<br>> trustworthiness of the information presented in the certificate, much<br>> like EV policy OIDs and OV policy OIDs reportedly provide a stronger<br>> level of assertion.<br><br>Did you anticipate a marker both for the validation method and also for the<br>version of the BRs used? Both would be needed to pin it down exactly.<br><br>Gerv<o:p></o:p></p></div></div><div><div><p class=MsoNormal>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p></div></div></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>