<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On 19 May 2017, at 3:43 pm, Ryan Sleevi <<a href="mailto:sleevi@google.com" class="">sleevi@google.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">How does that fit with the quoted Section 4.1.2?<div class=""><br class=""></div><div class="">"The<span style="white-space:pre" class=""> </span>certificate<span style="white-space:pre" class=""> </span>request MUST contain a request from, or on behalf of, the Applicant for the issuance of a Certificate, and a certification by, or on behalf of, the Applicant that all of the information contained therein is correct.”</div></div></div></blockquote><div><br class=""></div><div>4.1.2 starts with “Prior to the issuance of a Certificate”. So, at some point before the certificate issues, 4.1.2 needs to be satisfied. There’s no ordering between that and the validation requirements in the BRs.</div><br class=""><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="">1) If there is no certificate request, is there an Applicant at the time the CA begins validating information?</div></div></div></blockquote><div><br class=""></div><div>A validation is only relevant to the BRs if it leads to a certificate issuance. A certificate issuance must only occur after a certificate request which implies the existence of an Applicant to get the certificate request from. So, yes, there must have been an Applicant. The CA may not have known who.</div><div><br class=""></div><blockquote type="cite" class=""><div class=""><div dir="ltr" class=""><div class="">2) If there is no certificate request, and/or there is no Applicant, how is the information the CA validated conforming with Section 3.2, which Section 4.2.1 references?</div></div></div></blockquote><div><br class=""></div><div>There is always an Applicant and there must be a certificate request, see above.</div><div><br class=""></div><blockquote type="cite" class=""><div dir="ltr" class=""><div class="">Those are two reasons why I do not believe the scenario is permitted.</div></div></blockquote><div><br class=""></div><div>Those weren’t reasons, they were questions…</div><br class=""><blockquote type="cite" class=""><div class="gmail_extra">On Fri, May 19, 2017 at 6:37 PM, Geoff Keating <span dir="ltr" class=""><<a href="mailto:geoffk@apple.com" target="_blank" class="">geoffk@apple.com</a>></span> wrote:<br class=""><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hi Ryan,<br class="">
<br class="">
I don’t think there’s anything in the BRs that says that particular validation steps must happen before other steps, so long as the appropriate time limits are honored. Your example where a CA finds an existing certificate for a prospective customer, validates everything in that certificate (for example checking domain name against organization name using whois), and then contacts the prospective customer (for example, via postal address in company registration, matched against whois) and asks if they’d like a replacement certificate and if all the details are correct, seems permitted to me.<br class="">
<br class="">
</blockquote></div><br class=""></div>
</blockquote></div><br class=""></body></html>