<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Somehow this has become very complex, and I have to say I don’t understand what you are asking. I thought “the CA’s audits” was pretty clear and covered everything.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">I will leave it to Gerv to choose whatever wording he prefers.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Sent:</b> Saturday, June 24, 2017 8:10 PM<br>
<b>To:</b> Kirk Hall <Kirk.Hall@entrustdatacard.com>; CA/Browser Forum Public Discussion List <public@cabforum.org><br>
<b>Subject:</b> [EXTERNAL]Re: [cabfpub] Updating DTP definition<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Kirk,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Would you agree that your proposed wording introduces the issue that is avoided by the current wording, which is that a CA can easily misread this to suggest that, say, if the DTP is covered under the "WebTrust for CAs" audit, it need not
necessarily be covered under the "WebTrust for CAs - SSL Baseline w/ Net Sec" - even though the activities of the DTP mean it should?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I understand your goal with the plurality, but the problem is that it introduces an ambiguity as to the necessity of the relevant audits. Hopefully you can see why more specificity helps avoid this otherwise unnecessary ambiguity (that
being covered under 'an' audit is sufficient).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Similarly, consider the inverse - if there is a DTP who performs, say, datacenter activities, do you believe there are principles and criteria captured in the "WebTrust for CAs - SSL Baseline w/ NetSec" that would be relevant/necessary
for audit? Or would you agree that, depending on the scope and role of the datacenter provider, it may be that the only criteria and controls are captured within the "WebTrust for CAs" criteria.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Obviously, I use a bias towards WebTrust here, if only because the split is more obvious and apparent than the ETSI equivalents, and hopefully, it's one you're more familiar with, thus making it easier to see the problems with the proposed
wording change.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Sat, Jun 24, 2017 at 6:21 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Gerv, first thanks for doing this – it helps.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Second – I’m still thinking about the text of the addition. You propose “and whose activities are not within the
scope of the <u>appropriate CA audits</u>”. We discussed briefly at the meeting, and I know what you mean by the phrase and agree with it.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">The definition has two references to “the CA”, so I’m wondering if we should just use “the CA’s” in the new language
you would add. So the change would be as follows:</span><o:p></o:p></p>
<p style="margin-left:.5in"><b>Delegated Third Party</b>: A natural person or Legal Entity that is not the CA<b>, and whose activities are not within the scope of the
<i><s><span style="background:yellow">appropriate</span></s></i><span style="background:yellow"> CA<u>’s</u> audits</span>,</b> but is authorized by the CA to assist in the Certificate Management Process by performing or fulfilling one or more of the CA requirements
found herein.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">What do you think? I worry that including “appropriate” could create potential ambiguity as to which audits are
the “appropriate” ones for this definition. Saying “the CA’s audits” should cover all the CA’s audits. (If the DTP’s activities are not examined in a particular audit because of the nature of the audit, they are still within the “scope” of that audit.)</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Public [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a>]
<b>On Behalf Of </b>Gervase Markham via Public<br>
<b>Sent:</b> Thursday, June 22, 2017 4:29 AM<br>
<b>To:</b> CABFPub <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>
<b>Cc:</b> Gervase Markham <<a href="mailto:gerv@mozilla.org" target="_blank">gerv@mozilla.org</a>><br>
<b>Subject:</b> [EXTERNAL][cabfpub] Updating DTP definition</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p>Before we move the ballot forbidding DTPs from doing domain validation, we need to update the definition of DTP to make sure it excludes people and activities covered by the CA's audit.<br>
<br>
The current definition is:<br>
<br>
<b>Delegated Third Party</b>: A natural person or Legal Entity that is not the CA but is authorized by the CA to assist in the Certificate Management Process by performing or fulfilling one or more of the CA requirements found herein.<o:p></o:p></p>
<p>Here is a proposed updated definition:<o:p></o:p></p>
<p><b>Delegated Third Party</b>: A natural person or Legal Entity that is not the CA<b>, and whose activities are not within the scope of the appropriate CA audits,</b> but is authorized by the CA to assist in the Certificate Management Process by performing
or fulfilling one or more of the CA requirements found herein.<o:p></o:p></p>
<p>Does<o:p></o:p></p>
<p>Gerv<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>