<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.m-7541139769902924714msoplaintext, li.m-7541139769902924714msoplaintext, div.m-7541139769902924714msoplaintext
{mso-style-name:m_-7541139769902924714msoplaintext;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.m-7541139769902924714msolistparagraph, li.m-7541139769902924714msolistparagraph, div.m-7541139769902924714msolistparagraph
{mso-style-name:m_-7541139769902924714msolistparagraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">These came from Doug, and as I recall were previously posted to the public list before we stopped working on Ballot 190. I’ll let Doug respond.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Sent:</b> Wednesday, August 30, 2017 7:50 AM<br>
<b>To:</b> Kirk Hall <Kirk.Hall@entrustdatacard.com>; CA/Browser Forum Public Discussion List <public@cabforum.org><br>
<b>Subject:</b> [EXTERNAL]Re: [cabfpub] Ballot 190 v7<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Tue, Aug 29, 2017 at 8:03 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Mads and Doug are still endorsers for the restart of Ballot 190. Doug reminded me of five changes that we had agreed to make to the last version, v7. The changes are shown on
the attached v7 in <span style="background:yellow">yellow</span>, and are also listed below. When we do the restart on Ballot 190, it will be with this v7 version.<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Can you indicate where those v7 changes came from? That is, was this private discussions among the Ballot endorsers, suggestions you made, items from the Validation WG (call or list?), etc?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Here are the changes from v6 that were made in the attached v7:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">1. [In BR 3.2.2.4 introduction]: The CA SHALL confirm that, as of the date the Certificate issues, <<u><span style="background:yellow">is issued</span></u>?><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">"is issued" would be past-tense, implying it's a post-issuance activity, rather than a (pre-)issuance activity - right?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="m-7541139769902924714msoplaintext">2. [In all 10 validation method Notes:] Note: Once the FQDN has been validated using this method, the CA MAY also issue Certificates for other FQDNs that end with all the labels of the validated FQDN and have
<u><span style="background:yellow">the same or</span></u> more labels than it. This method is suitable for validating Wildcard Domain Names.<o:p></o:p></p>
<p class="m-7541139769902924714msolistparagraph" style="margin-left:20.4pt">-<span style="font-size:7.0pt">
</span>The above note appears in multiple places, all need to be updated.<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal">It reads fairly clunky - more was clearer as a numeric comparison, but 'the same or more labels than it' leaves ambiguity as to whether it's equality of the labels (which is handled by the preceding clause).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Beyond the longstanding concerns about expressing the "Notes" here and their impact on normative expressions, I'm not sure the change is actually necessary - that is, the only FQDN that 'ends with all the labels of the validated FQDN and
has the same number of labels in it' is, well, the FQDN. Is that actually necessary to express - you're saying that after the FQDN has been validated, Certificates may also be issued for the FQDN.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The current wording avoids this issue, because 'the current FQDN' will never have more labels in it than the current FQDN :)<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">3. [In BR 3.2.2.4.6]: The presence of Required Website Content contained in the content of a file
<s><span style="background:yellow">or on a web page in the form of a meta tag</span>.
</s><we agreed that a web page is a file, so no need><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">4. [In BR 3.2.2.4.6]: Missing “T”: “This method is suitable for validating Wildcard Domain Names.”
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">5. [In BR 3.2.2.4.7]: I’ve commented on this multiple times and I think as written it’s not clear:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">From this:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:6.0pt;margin-left:.5in;background:white">
Confirming the Applicant's control over the FQDN by confirming the presence of a Random Value or Request Token in a DNS CNAME, TXT or CAA record for an Authorization Domain Name or an Authorization Domain Name that is prefixed with a label that begins with
an underscore character.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">To this:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:.5in">
Confirming the Applicant's control over the FQDN by confirming the presence of a Random Value or Request Token in
<span style="background:yellow">either 1)</span> a DNS CNAME, TXT or CAA record for an Authorization Domain Name or
<span style="background:yellow">2)</span> an Authorization Domain Name that is prefixed with a label that begins with an underscore character.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a name="m_-7541139769902924714__MailEndCompose"></a><o:p> </o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Kirk,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Could you highlight where you've commented on 3.2.2.4.7 in the past? I want to make sure I better understand your concerns here.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I highlight this because the choice of where to place your either/or is significant. You've placed 1) before the "CNAME, TXT, or CAA record" - which means that 2) can be expressed in any way (for example, an MX record would be sufficient,
it would seem). That certainly doesn't sound correct, but I want to make sure I'm understanding your concerns.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The alternative way to express this would be reworded as:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">or Request Token in a DNS CNAME, TXT, or CAA record for either:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 1) an Authorization Domain Name; or,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> 2) an Authorization Domain Name that is prefixed with a label that begins with an underscore character.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">In this case, we make it clear that the Request Token or Random Value still must appear within those record types.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</body>
</html>