<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On May 20, 2017, at 8:11 AM, Peter Bowen <<a href="mailto:pzb@amzn.com" class="">pzb@amzn.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">On May 20, 2017, at 7:41 AM, Ryan Sleevi via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Fri, May 19, 2017 at 9:47 PM, Jeremy Rowley <span dir="ltr" class=""><<a href="mailto:jeremy.rowley@digicert.com" target="_blank" class="">jeremy.rowley@digicert.com</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div lang="EN-US" link="blue" vlink="purple" class=""><div class="m_1770955601813563182WordSection1"><p class="MsoNormal">“The certificate request MAY include all factual information about the Applicant to be included in the Certificate, and such additional information as is necessary for the CA to obtain from the Applicant in order to comply with these Requirements and the CA’s Certificate Policy and/or Certification Practice Statement.”<u class=""></u><u class=""></u></p><ul style="margin-top:0in" type="disc" class=""><li class="m_1770955601813563182MsoListParagraph" style="margin-left:0in">This indicates a certificate request may include partial information.</li></ul></div></div></blockquote><div class="">I appreciate you mentioning this - as I've mentioned it several times - but this doesn't address the concern related to 4.1.2</div></div></div></div></div></blockquote><br class=""></div><div class="">How about we solve this by changing 4.2.1 to say:</div><div class=""><br class=""></div><div class="">"The CA MUST have obtained documents and data used to verify certificate information no more than 825 days prior to issuing the Certificate.”</div><div class=""><br class=""></div><div class="">This could also move to section 3.2 itself to help readers and implementers, as having it down in 4.2.1 has clearly caused confusion.</div></div></div></blockquote><br class=""></div><div>Looking back at this thread, I suggest we also modify 3.2.2.4:</div><div><br class=""></div><div>The CA MUST confirm, prior to certificate issuance, that either the CA or a Delegated Third Party has
validated each Fully‐Qualified Domain Name (FQDN) listed in the Certificate using either one of the methods
listed below or a method that was allowed by the Baseline Requirements if effect at the time of validation. The validation must have occurred no more than 825 days prior to certificate issuance.</div></body></html>