<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Sat, May 20, 2017 at 10:41 AM, Ryan Sleevi <span dir="ltr"><<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote"><span class="gmail-">On Fri, May 19, 2017 at 9:47 PM, Jeremy Rowley <span dir="ltr"><<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div lang="EN-US"><div class="gmail-m_-1685904229182821182m_1770955601813563182WordSection1"><p class="MsoNormal">“The certificate request MAY include all factual information about the Applicant to be included in the Certificate, and such additional information as is necessary for the CA to obtain from the Applicant in order to comply with these Requirements and the CA’s Certificate Policy and/or Certification Practice Statement.”<u></u><u></u></p><ul style="margin-top:0in" type="disc"><li class="gmail-m_-1685904229182821182m_1770955601813563182MsoListParagraph" style="margin-left:0in">This indicates a certificate request may include partial information.</li></ul></div></div></blockquote></span><div>I appreciate you mentioning this - as I've mentioned it several times - but this doesn't address the concern related to 4.1.2</div></div></div></div></blockquote><div><br></div><div>Apologies, that sent too soon.</div><div><br></div><div>Let's look at 4.1.2 and 4.2.1 combined:</div><div><br></div><div>From 4.2.1:</div><div>The certificate request MAY include all factual information about the Applicant to be included in the
Certificate, and such additional information as is necessary for the CA to obtain from the Applicant in order to
comply with these Requirements and the CA’s Certificate Policy and/or Certification Practice Statement. In
cases where the certificate request does not contain all the necessary information about the Applicant, the CA
SHALL obtain the remaining information from the Applicant or, having obtained it from a reliable,
independent, third‐party data source, confirm it with the Applicant. The CA SHALL establish and follow a
documented procedure for verifying all data requested for inclusion in the Certificate by the Applicant.</div><div><br></div><div>Applicant information MUST include, but not be limited to, at least one Fully‐Qualified Domain Name or IP
address to be included in the Certificate’s SubjectAltName extension.</div><div><br></div><div>From 4.1.2</div><div>Prior to the issuance of a Certificate, the CA SHALL obtain the following documentation from the Applicant:</div><div>1. A certificate request, which may be electronic; and</div><div>2. An executed Subscriber Agreement or Terms of Use, which may be electronic.</div><div><br></div><div>The CA SHOULD obtain any additional documentation the CA determines necessary to meet these
Requirements<br></div><div><br></div><div>Prior to the issuance of a Certificate, the CA SHALL obtain from the Applicant a certificate request in a form
prescribed by the CA and that complies with these Requirements. One certificate request MAY suffice for
multiple Certificates to be issued to the same Applicant, subject to the aging and updating requirement in
Section 3.3.1, provided that each Certificate is supported by a valid, current certificate request signed by the
appropriate Applicant Representative on behalf of the Applicant. The certificate request MAY be made,
submitted and/or signed electronically. </div><div><br></div><div>The certificate request MUST contain a request from, or on behalf of, the Applicant for the issuance of a
Certificate, and a certification by, or on behalf of, the Applicant that all of the information contained therein is
correct. <br></div></div><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">From these two, it's important to note what constitutes a request:</div><div class="gmail_extra">A) A request from, or on behalf of, the Applicant for the issuance of a certificate</div><div class="gmail_extra">B) A certification by, or on behalf of, the Applicant that all of the information contained therein [in the request] is correct</div><div class="gmail_extra">C) At least one Fully-Qualified Domain Name or IP address to be included in the Certificate's SubjectAltName extension</div><div class="gmail_extra"><br></div><div class="gmail_extra">Are we at least in agreement that these three represent the _minimum_ necessary and sufficient conditions to constitute "A Request"?</div><div class="gmail_extra"><br></div><div class="gmail_extra">Further, a Request MAY, but not necessarily, "include all factual information about the Applicant to be included in the Certificate". "In cases where the certificate request does not contain all the necessary information about the Applicant", the information requested by the Applicant is not part of the Request, and "the CA SHALL obtain the remaining information from the Applicant or, having obtained it from a reliable, independent, third‐party data source, confirm it with the Applicant."</div><div class="gmail_extra"><br></div><div class="gmail_extra">Hopefully this establishes that CAs MAY include additional information, in addition to the Request.</div><div class="gmail_extra"><br></div><div class="gmail_extra"><br></div><div class="gmail_extra">Are we in agreement so far, at least with this?</div><div class="gmail_extra"><br></div><div class="gmail_extra">This leads to two possible interpretations:</div><div class="gmail_extra">1) A Request is only made when A-C are present. Until such time, a Request has not been made. Because a Request has not been made, an Applicant does not exist. Because an Applicant does not exist, the information cannot be validated pursuant to Section 3.2</div><div class="gmail_extra">2) A Request can be made without any of A-C present, on the basis that it's possible to omit all three of these, because it is a "case where the certificate request does not contain all the necessary information about the Applicant". That is, there is no such requirement for a Request for there to be an Applicant - an Applicant is simply an idea - and the CA can gather information about parties, validate them, and - provided they gather A-C at some point prior to the issuance of a certificate - issue a certificate.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Is it at least clear how we can reach these two interpretations?</div><div class="gmail_extra"><br></div></div>