<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.m-6506663678236423459msolistparagraph, li.m-6506663678236423459msolistparagraph, div.m-6506663678236423459msolistparagraph
{mso-style-name:m_-6506663678236423459msolistparagraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.m-6506663678236423459msoplaintext, li.m-6506663678236423459msoplaintext, div.m-6506663678236423459msoplaintext
{mso-style-name:m_-6506663678236423459msoplaintext;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.m-6506663678236423459line874, li.m-6506663678236423459line874, div.m-6506663678236423459line874
{mso-style-name:m_-6506663678236423459line874;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.m-6506663678236423459line862, li.m-6506663678236423459line862, div.m-6506663678236423459line862
{mso-style-name:m_-6506663678236423459line862;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:2080203966;
mso-list-template-ids:426006920;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I think we should focus on the core changes to remove “any other method” before we start adding more changes to indicate the version of the BRs that were used,
so I would recommend not including this in ballot 190. We have enough discussion points now, especially if we’re considering anything in Jeremy’s latest proposal.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Doug<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></a></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Public [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>Ryan Sleevi via Public<br>
<b>Sent:</b> Wednesday, May 17, 2017 12:25 PM<br>
<b>To:</b> CA/Browser Forum Public Discussion List <public@cabforum.org><br>
<b>Cc:</b> Ryan Sleevi <sleevi@google.com><br>
<b>Subject:</b> Re: [cabfpub] Preballot - Revised Ballot 190<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Kirk,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I didn't see an answer to this question posed - <a href="https://cabforum.org/pipermail/public/2017-April/010802.html">https://cabforum.org/pipermail/public/2017-April/010802.html</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">For example, proposed technical details were provided in <a href="https://cabforum.org/pipermail/public/2017-May/010848.html">https://cabforum.org/pipermail/public/2017-May/010848.html</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Would you (and Jeremy and Gerv) be receptive to including this in 3.2.2.4? I'd be happy to write the text to accomplish this, but I was under the misunderstanding that the lack of reply meant y'all were considering it.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There did not appear to be any objections raised on the list - simply a discussion related to policy OIDs versus an extension, but the the extension provides a semantically valid approach that minimizes any changes to CA infrastructure.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Wed, May 17, 2017 at 12:17 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Jeremy, Gerv, and I have worked on this revised version of Ballot 190, and offer it for comment as a preballot.
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">A few points to highlight.<o:p></o:p></p>
<p class="m-6506663678236423459msolistparagraph">-<span style="font-size:7.0pt">
</span>There is now a new fifth paragraph in the introductory part of BR 3.2.2.4 that requires CAs to maintain a record of which domain validation method they use (including version number) for each validated domain. This is to add more flexibility in the
future if methods must be changed and existing domains revalidated for some reason.<o:p></o:p></p>
<p class="m-6506663678236423459msolistparagraph">-<span style="font-size:7.0pt">
</span>The new sixth paragraph clarifies that domains validated prior to the effective date of Ballot 190 are not required to be revalidated, but the validation data can be reused for the periods specified in BR 4.2.1 and EVGL 11.14.3.
<o:p></o:p></p>
<p class="m-6506663678236423459msolistparagraph">-<span style="font-size:7.0pt">
</span>We also have added a line to each validation method indicating whether or not the validation method is suitable for wildcard certificates.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">I will try to create and circulate a “show changes” version of BR 3.2.2.4 that shows all these changes against the current language.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">***<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<a name="m_-6506663678236423459_texteditlink"><b><span lang="EN">Ballot 190 - Revised Validation Requirements</span></b></a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span lang="EN">Purpose of Ballot:</span></b><span lang="EN"> The purpose of this ballot is to 1) re-introduce the BR 3.2.2.4 domain validation methods removed in ballot 180-182 because of IPR concerns, 2) clarify some issues with the .well-known method,
3) specify how the reuse of information works with respect to the newly adopted methods, and (4) indicate which domain validation methods are suitable for wildcard certificates.
</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">The following motion has been proposed by Jeremy Rowley of DigiCert and endorsed by the following CA/B Forum member representatives: Chris Bailey of Entrust Datacard and YYYY to
introduce new Final Maintenance Guidelines for the "Baseline Requirements Certificate Policy for the Issuance and Management of Publicly-Trusted Certificates" (Baseline Requirements).<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span lang="EN">--Motion Begins--</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span lang="EN">Ballot Section 1</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">1) The introductory paragraphs to BR 3.2.2.4 are amended as follows:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
<b><i>3.2.2.4. Validation of Domain Authorization or Control</i></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
This section defines the permitted processes and procedures for validating the Applicant's ownership or control of the domain.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
The CA SHALL confirm that, as of the date the Certificate issues, either the CA or a Delegated Third Party has validated each Fully<span style="font-family:"Cambria Math",serif">‐</span>Qualified Domain Name (FQDN) listed in the Certificate using at least one
of the methods listed below.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
Completed confirmations of Applicant authority may be valid for the issuance of multiple certificates over time. In all cases, the confirmation must have been initiated within the time period specified in the relevant requirement (such as Section 4.2.1 of this
document) prior to certificate issuance. For purposes of domain validation, the term Applicant includes the Applicant's Parent Company, Subsidiary Company, or Affiliate.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
Note: FQDNs may be listed in Subscriber Certificates using dNSNames in the subjectAltName extension or in Subordinate CA Certificates via dNSNames in permittedSubtrees within the Name Constraints extension.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
CAs SHALL maintain a record of which domain validation method, including relevant BR version number, they used to validate every domain.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-autospace:none">
After <i>[insert effective date of Ballot 190],</i> a CA MAY continue to reuse validation data from its validation of an FQDN under the methods listed in (a) BR 4.3.3.2 of Version 1.3.7 (or earlier) of the Baseline Requirements, (b) BR 4.3.3.2 of Version 1.3.8
to 1.4.1 of the Baseline Requirements, or (c) BR 3.2.2.4 of Version 1.4.2 to 1.4.x
<i>[insert most recent version number for the BRs at time this ballot becomes effective]
</i>of the Baseline Requirements for the periods specified in BR 4.2.1 or the EVGL 11.14.3.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">2) Replace Section 3.2.2.4.1:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span lang="EN">3.2.2.4.1 Validating the Applicant as a Domain Contact</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">Confirming the Applicant's control over the FQDN by validating the Applicant is the Domain Contact directly with the Domain Name Registrar. This method may only be used if:</span><o:p></o:p></p>
<ol start="1" type="1">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1;background:white">
<span lang="EN">The CA authenticates the Applicant's identity under BR Section 3.2.2.1 and the authority of the Applicant Representative under BR Section 3.2.5, OR</span><o:p></o:p></li><li class="MsoNormal" style="margin-top:6.0pt;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1;background:white">
<span lang="EN">The CA authenticates the Applicant's identity under EV Guidelines Section 11.2 and the agency of the Certificate Approver under EV Guidelines Section 11.8; OR</span><o:p></o:p></li><li class="MsoNormal" style="margin-top:6.0pt;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1;background:white">
<span lang="EN">The CA is also the Domain Name Registrar, or an Affiliate of the Registrar, of the Base Domain Name.</span><o:p></o:p></li></ol>
<p class="m-6506663678236423459msoplaintext"><u><span lang="EN">Note</span></u><span lang="EN">:
</span>This method is suitable for validating domains for wildcard issuance.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">3) Replace Section 3.2.2.4.2:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span lang="EN">3.2.2.4.2 Email, Fax, SMS, or Postal Mail to Domain Contact</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">Confirming the Applicant's control over the FQDN by sending a Random Value via email, fax, SMS, or postal mail and then receiving a confirming response utilizing the Random Value. The Random Value MUST be sent to an email address, fax/SMS number,
or postal mail address identified as a Domain Contact.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">Each email, fax, SMS, or postal mail MAY confirm control of multiple Authorization Domain Names.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">The CA or Delegated Third Party MAY send the email, fax, SMS, or postal mail identified under this section to more than one recipient provided that every recipient is identified by the Domain Name Registrar as representing the Domain Name Registrant
for every FQDN being verified using the email, fax, SMS, or postal mail.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">The Random Value SHALL be unique in each email, fax, SMS, or postal mail.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">The CA or Delegated Third Party MAY resend the email, fax, SMS, or postal mail in its entirety, including re-use of the Random Value, provided that the communication's entire contents and recipient(s) remain unchanged.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">The Random Value SHALL remain valid for use in a confirming response for no more than 30 days from its creation. The CPS MAY specify a shorter validity period for Random Values, in which case the CA MUST follow its CPS.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<u><span lang="EN">Note</span></u><span lang="EN">: </span>This method is suitable for validating domains for wildcard issuance.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">4) Replace Section 3.2.2.4.3:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span lang="EN">3.2.2.4.3 Phone Contact with Domain Contact</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">Confirming the Applicant's control over the requested FQDN by calling the Domain Name Registrant's phone number and obtaining a response confirming the Applicant's request for validation of the FQDN. The CA or Delegated Third Party MUST place
the call to a phone number identified by the Domain Name Registrar as the Domain Contact.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">Each phone call SHALL be made to a single number and MAY confirm control of multiple FQDNs, provided that the phone number is identified by the Domain Registrar as a valid contact method for every Base Domain Name being verified using the phone
call.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<u><span lang="EN">Note</span></u><span lang="EN">: </span>This method is suitable for validating domains for wildcard issuance.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">5) Replace Section 3.2.2.4.4:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span lang="EN">3.2.2.4.4 Constructed Email to Domain Contact</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">Confirm the Applicant's control over the requested FQDN by (i) sending an email to one or more addresses created by using 'admin', 'administrator', 'webmaster', 'hostmaster', or 'postmaster' as the local part, followed by the at-sign ("@"),
followed by an Authorization Domain Name, (ii) including a Random Value in the email, and (iii) receiving a confirming response utilizing the Random Value.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">Each email MAY confirm control of multiple FQDNs, provided the Authorization Domain Name used in the email is an Authorization Domain Name for each FQDN being confirmed</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">The Random Value SHALL be unique in each email.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">The email MAY be re-sent in its entirety, including the re-use of the Random Value, provided that its entire contents and recipient SHALL remain unchanged.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">The Random Value SHALL remain valid for use in a confirming response for no more than 30 days from its creation. The CPS MAY specify a shorter validity period for Random Values, in which case the CA.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<u><span lang="EN">Note</span></u><span lang="EN">: </span>This method is suitable for validating domains for wildcard issuance.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">6) Add the following to the end of Section 3.2.2.4.5:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<u><span lang="EN">Note</span></u><span lang="EN">: </span>This method is suitable for validating domains for wildcard issuance.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">7) Edit Section 3.2.2.4.6:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span lang="EN">3.2.2.4.6 Agreed-Upon Change to Website</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
Confirming the Applicant's control over the requested FQDN by confirming <u>the presence of a Request Token or Random Value contained in the content of a file or on a web page in the form of a meta tag</u> <s>one of the following</s> under the "/.well<span style="font-family:"Cambria Math",serif">‐</span>known/pki<span style="font-family:"Cambria Math",serif">‐</span>validation"
directory, or another path registered with IANA for the purpose of Domain Validation, on the Authorization Domain Name that is accessible by the CA via HTTP/HTTPS over an Authorized Port<u>. The Request Token or Random Value MUST NOT appear in the request
for the file or web-page. </u> <s>:</s><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<s>1. The presence of Required Website Content contained in the content of a file or on a web page in the form of a meta tag. The entire Required Website Content MUST NOT appear in the request used to retrieve the file or web page, or</s><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<s>2. The presence of the Request Token or Request Value contained in the content of a file or on a webpage in the form of a meta tag where the Request Token or Random Value MUST NOT appear in the request.</s><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
If a Random Value is used, the CA or Delegated Third Party SHALL provide a Random Value unique to the certificate request and SHALL not use the Random Value after the longer of (i) 30 days or (ii) if the Applicant submitted the certificate request, the timeframe
permitted for reuse of validated information relevant to the certificate (such as in Section 3.3.1 of these Guidelines or Section 11.14.3 of the EV Guidelines).<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
Note: Examples of Request Tokens include, but are not limited to: (i) a hash of the public key; (ii) a hash of the Subject Public Key Info [X.509]; and (iii) a hash of a PKCS#10 CSR. A Request Token may also be concatenated with a timestamp or other data. If
a CA wanted to always use a hash of a PKCS#10 CSR as a Request Token and did not want to incorporate a timestamp and did want to allow certificate key re<span style="font-family:"Cambria Math",serif">‐</span>use then the applicant might use the challenge password
in the creation of a CSR with OpenSSL to ensure uniqueness even if the subject and key are identical between subsequent requests. This simplistic shell command produces a Request Token which has a timestamp and a hash of a CSR. E.g.
<span lang="EN-GB">echo `date -u +%Y%m%d%H%M` `sha256sum <r2.csr` | sed "s/[ -]//g"</span>. The script outputs:201602251811c9c863405fe7675a3988b97664ea6baf442019e4e52fa335f406f7c5f26cf14f<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span style="background:white">The CA should define in its CPS (or in a document referenced from the CPS) the format of Request Tokens it accepts.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<u><span lang="EN">Note</span></u><span lang="EN">: </span>This method is suitable for validating domains for wildcard issuance.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">8) Add Section 3.2.2.4.7:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span lang="EN">3.2.2.4.7 DNS Change</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">Confirming the Applicant's control over the requested FQDN by confirming the presence of a Random Value or Request Token in a DNS
<u>CNAME,</u> TXT, or CAA record for an Authorization Domain Name or an Authorization Domain Name that is prefixed with a label that begins with an underscore character.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">If a Random Value is used, the CA or Delegated Third Party SHALL provide a Random Value unique to the certificate request and SHALL not use the Random Value after (i) 30 days or (ii) if the Applicant submitted the certificate request, the timeframe
permitted for reuse of validated information relevant to the certificate (such as in Section 3.3.1 of these Guidelines or Section 11.14.3 of the EV Guidelines).</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<u><span lang="EN">Note</span></u><span lang="EN">: </span>This method is suitable for validating domains for wildcard issuance.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">9) Add Section 3.2.2.4.8:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span lang="EN">3.2.2.4.8 IP Address</span></b><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">Confirming the Applicant's control over the requested FQDN by confirming that the Applicant controls an IP address returned from a DNS lookup for A or AAAA records for the FQDN in accordance with section 3.2.2.5.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<u><span lang="EN">Note</span></u><span lang="EN">: </span>This method is NOT suitable for validating domains for wildcard issuance.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">10) Add Section 3.2.2.4.9:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b>3.2.2.4.9 Test Certificate</b> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
Confirming the Applicant's control over the requested FQDN by confirming the presence of a non<span style="font-family:"Cambria Math",serif">‐</span>expired Test Certificate issued by the CA on the Authorization Domain Name and which is accessible by the CA
via TLS over an Authorized Port for the purpose of issuing a Certificate with the same Public Key as in the Test Certificate.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<u><span lang="EN">Note</span></u><span lang="EN">: </span>This method is suitable for validating domains for wildcard issuance.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">11) Add the following to the end of Section 3.2.2.4.10:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<u><span lang="EN">Note</span></u><span lang="EN">: </span>This method is suitable for validating domains for wildcard issuance.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">12) Delete Section 3.2.2.4.11</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span lang="EN">13) Delete the definition of “Required Website Content”</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<span style="background:white">14) Revised the definition of “Authorized Ports” as follows:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">One of the following ports: 80 (http), 443 (http),
<s>115 (sftp), </s>25 (smtp), 22 (ssh).<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
15) Revise the definition of Test Certificate as follows:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b>Test Certificate</b>: A Certificate with a maximum validity period of 30 days and which: (i) includes a critical extension with the specified Test Certificate CABF OID
<u>(2.23.140.2.1)</u>, or (ii) is issued under a CA where there are no certificate paths/chains to a root certificate subject to these Requirements<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;background:white">
<b><span lang="EN">--Motion Ends--</span></b><o:p></o:p></p>
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt">
<span style="font-size:11.0pt">The procedure for approval of this Final Maintenance Guideline ballot is as follows (exact start and end times may be adjusted to comply with applicable Bylaws and IPR Agreement):</span><o:p></o:p></p>
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt">
<span style="font-size:11.0pt"> </span><o:p></o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse">
<tbody>
<tr>
<td width="306" valign="top" style="width:229.25pt;border:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%">BALLOT 190</span><o:p></o:p></p>
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%">Status: Final Maintenance Guideline</span><o:p></o:p></p>
</td>
<td width="110" valign="top" style="width:82.4pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt">
<p class="m-6506663678236423459line874" align="center" style="margin:0in;margin-bottom:.0001pt;text-align:center;line-height:105%">
<span style="font-size:11.0pt;line-height:105%">Start time (23:00 UTC)</span><o:p></o:p></p>
</td>
<td width="106" valign="top" style="width:79.35pt;border:solid windowtext 1.0pt;border-left:none;padding:0in 5.4pt 0in 5.4pt">
<p class="m-6506663678236423459line874" align="center" style="margin:0in;margin-bottom:.0001pt;text-align:center;line-height:105%">
<span style="font-size:11.0pt;line-height:105%">End time (23:00 UTC)</span><o:p></o:p></p>
</td>
</tr>
<tr>
<td width="306" valign="top" style="width:229.25pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%">Discussion (7 to 14 days)</span><o:p></o:p></p>
</td>
<td width="110" valign="top" style="width:82.4pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="m-6506663678236423459line874" align="center" style="margin:0in;margin-bottom:.0001pt;text-align:center;line-height:105%">
<span style="font-size:11.0pt;line-height:105%"> </span><o:p></o:p></p>
</td>
<td width="106" valign="top" style="width:79.35pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal" align="center" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:center">
<o:p></o:p></p>
</td>
</tr>
<tr>
<td width="306" valign="top" style="width:229.25pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%">Vote for approval (7 days)</span><o:p></o:p></p>
</td>
<td width="110" valign="top" style="width:82.4pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal" align="center" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:center">
<o:p></o:p></p>
</td>
<td width="106" valign="top" style="width:79.35pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal" align="center" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:center">
<o:p></o:p></p>
</td>
</tr>
<tr>
<td width="306" valign="top" style="width:229.25pt;border:solid windowtext 1.0pt;border-top:none;padding:0in 5.4pt 0in 5.4pt">
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%">If vote approves ballot: Review Period (Chair to send Review Notice) (30 days).
</span><o:p></o:p></p>
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%">If Exclusion Notice(s) filed, ballot approval is rescinded and PAG to be created.</span><o:p></o:p></p>
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<span style="font-size:11.0pt;line-height:105%">If no Exclusion Notices filed, ballot becomes effective at end of Review Period.</span><o:p></o:p></p>
</td>
<td width="110" valign="top" style="width:82.4pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal" align="center" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:center">
Upon filing of Review Notice by Chair<o:p></o:p></p>
</td>
<td width="106" valign="top" style="width:79.35pt;border-top:none;border-left:none;border-bottom:solid windowtext 1.0pt;border-right:solid windowtext 1.0pt;padding:0in 5.4pt 0in 5.4pt">
<p class="MsoNormal" align="center" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;text-align:center">
30 days after filing of Review Notice by Chair<o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt">
<span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt">
<span style="font-size:11.0pt">From Bylaw 2.3: If the Draft Guideline Ballot is proposing a Final Maintenance Guideline, such ballot will include a redline or comparison showing the set of changes from the Final Guideline section(s) intended to become a Final
Maintenance Guideline, and need not include a copy of the full set of guidelines. Such redline or comparison shall be made against the Final Guideline section(s) as they exist at the time a ballot is proposed, and need not take into consideration other ballots
that may be proposed subsequently, except as provided in Bylaw Section 2.3(j).</span><o:p></o:p></p>
<p class="m-6506663678236423459line874" style="margin:0in;margin-bottom:.0001pt">
<span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="m-6506663678236423459line862" style="margin:0in;margin-bottom:.0001pt">
<span style="font-size:11.0pt">Votes must be cast by posting an on-list reply to this thread on the Public list. A vote in favor of the motion must indicate a clear 'yes' in the response. A vote against must indicate a clear 'no' in the response. A vote to
abstain must indicate a clear 'abstain' in the response. Unclear responses will not be counted. The latest vote received from any representative of a voting member before the close of the voting period will be counted. Voting members are listed here:
</span><a href="https://cabforum.org/members/" target="_blank"><span style="font-size:11.0pt;color:windowtext">https://cabforum.org/members/</span></a><span style="font-size:11.0pt">
</span><o:p></o:p></p>
<p class="m-6506663678236423459line862" style="margin:0in;margin-bottom:.0001pt">
<span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">In order for the motion to be adopted, two thirds or more of the votes cast by members in the CA category and greater than 50% of the votes cast by members in the browser category
must be in favor. <span style="background:white">Quorum is shown on CA/Browser Forum wiki. Under Bylaw 2.2(g), at least the required quorum number must participate in the ballot for the ballot to be valid, either by voting in favor, voting against, or abstaining.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:12.0pt"><br>
<br>
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>