<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1256">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div>
<div style="font-family:Calibri,sans-serif; font-size:11pt">Wayne,<br>
Can you give an example of what embedding would look like?<br>
Thanks,<br>
Ben</div>
</div>
<div dir="ltr">
<hr>
<span style="font-family:Calibri,sans-serif; font-size:11pt; font-weight:bold">From:
</span><span style="font-family:Calibri,sans-serif; font-size:11pt"><a href="mailto:wthayer@godaddy.com">Wayne Thayer</a></span><br>
<span style="font-family:Calibri,sans-serif; font-size:11pt; font-weight:bold">Sent:
</span><span style="font-family:Calibri,sans-serif; font-size:11pt">ý8/ý1/ý2017 3:58 PM</span><br>
<span style="font-family:Calibri,sans-serif; font-size:11pt; font-weight:bold">To:
</span><span style="font-family:Calibri,sans-serif; font-size:11pt"><a href="mailto:ben.wilson@digicert.com">Ben Wilson</a>;
<a href="mailto:public@cabforum.org">CA/Browser Forum Public Discussion List</a>;
<a href="mailto:gerv@mozilla.org">Gervase Markham</a>; <a href="mailto:Kirk.Hall@entrustdatacard.com">
Kirk Hall</a></span><br>
<span style="font-family:Calibri,sans-serif; font-size:11pt; font-weight:bold">Subject:
</span><span style="font-family:Calibri,sans-serif; font-size:11pt">Re: [cabfpub] [EXTERNAL]Re: Ballot 190 - Recording BR Version Number</span><br>
<br>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">The original concern I raised was with the ballot 190 requirement that CAs begin to log the BR version number associated with the validation method used on each request. My concerns are:<br>
1. The BR version doesn’t clearly indicate when a validation method has changed. As has been stated, the BR version number will surely increment for many reasons unrelated to validation methods. BR version 1.8.3 is likely to have the same meaning as version
2.1.6 in terms of validation methods.<br>
2. CAs will review changes to the validation methods and come to different conclusions as to what changes require the BR version number to be incremented in their logs. Is a wording change material, even though I’m not updating the code? The ballot author should
decide this.<br>
3. CAs generally need to implement changes to methods prior to a BR version number even being assigned. I closely review ballots, but I don’t track BR version numbers.<br>
<br>
This led me to propose a version number embedded in section 3.2.2.4 of the BRs that covers either all validation methods or one for each method – it doesn’t matter to me. This approach:<br>
1. Provides clear guidance that the CA must update the version number they’re logging as part of implementing a particular change<br>
2. 2. Allows CAs to make changes based on approved ballots rather than being dependent on BR version numbers<br>
3. Doesn’t require a separate section of the BRs to be updated and kept in synch<br>
4. Can easily be added to ballot 190 while we’re waiting for ballot 202<br>
<br>
Thanks,<br>
<br>
Wayne<br>
<br>
<br>
On 8/1/17, 9:28 AM, "Public on behalf of Ben Wilson via Public" <public-bounces@cabforum.org on behalf of public@cabforum.org> wrote:<br>
<br>
There are two sides to this - one is with the CAs, where they record what <br>
method was used, and the other is at the CA/Browser Forum level, where someone
<br>
maintains a chart, or whatever, of validation methods in effect, and <br>
historically which ones were effective during which periods.<br>
<br>
<br>
-----Original Message-----<br>
From: Gervase Markham [<a href="mailto:gerv@mozilla.org">mailto:gerv@mozilla.org</a>]<br>
Sent: Tuesday, August 1, 2017 10:06 AM<br>
To: Ben Wilson <ben.wilson@digicert.com>; CA/Browser Forum Public Discussion <br>
List <public@cabforum.org>; Kirk Hall <Kirk.Hall@entrustdatacard.com><br>
Subject: Re: [cabfpub] [EXTERNAL]Re: Ballot 190 - Recording BR Version Number<br>
<br>
On 01/08/17 17:00, Ben Wilson wrote:<br>
> Are we talking about what the CA records in its database for the<br>
> validation method used, or are we talking about annotating the BRs<br>
> with a record of when a change was made?<br>
<br>
I am raising the problem that if there is a list of changes made and it goes <br>
out of sync with reality, then what do I, at Mozilla, do if a CA says "well, I
<br>
didn't realise that change had been made because it wasn't added to the <br>
official list"?<br>
<br>
There should be one and exactly one method of knowing when changes are made.<br>
<br>
Earlier, although perhaps not in this thread, someone suggested independent <br>
version numbers for each of the methods. That has a similar issue - there <br>
should be one and exactly one method of recording what validation method was <br>
used.<br>
<br>
Gerv<br>
<br>
<br>
</div>
</span></font>
</body>
</html>