<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.m-7541139769902924714msoplaintext, li.m-7541139769902924714msoplaintext, div.m-7541139769902924714msoplaintext
{mso-style-name:m_-7541139769902924714msoplaintext;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.m-7541139769902924714msolistparagraph, li.m-7541139769902924714msolistparagraph, div.m-7541139769902924714msolistparagraph
{mso-style-name:m_-7541139769902924714msolistparagraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><a name="_MailEndCompose"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></a></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-left:30.8pt"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Public [mailto:public-bounces@cabforum.org]
<b>On Behalf Of </b>Kirk Hall via Public<br>
<b>Sent:</b> Wednesday, August 30, 2017 10:54 AM<br>
<b>To:</b> Ryan Sleevi <sleevi@google.com>; CA/Browser Forum Public Discussion List <public@cabforum.org><br>
<b>Subject:</b> Re: [cabfpub] [EXTERNAL]Re: Ballot 190 v7<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:30.8pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">These came from Doug, and as I recall were previously posted to the public list before we stopped working on Ballot 190. I’ll let
Doug respond.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:30.8pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:30.8pt"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Ryan Sleevi [mailto:sleevi@google.com]
<br>
<b>Sent:</b> Wednesday, August 30, 2017 7:50 AM<br>
<b>To:</b> Kirk Hall <Kirk.Hall@entrustdatacard.com>; CA/Browser Forum Public Discussion List <public@cabforum.org><br>
<b>Subject:</b> [EXTERNAL]Re: [cabfpub] Ballot 190 v7<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">On Tue, Aug 29, 2017 at 8:03 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
Mads and Doug are still endorsers for the restart of Ballot 190. Doug reminded me of five changes that we had agreed to make to the last version, v7. The changes are shown on the attached v7 in
<span style="background:yellow">yellow</span>, and are also listed below. When we do the restart on Ballot 190, it will be with this v7 version.<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">Can you indicate where those v7 changes came from? That is, was this private discussions among the Ballot endorsers, suggestions you made, items from the Validation WG (call or list?), etc?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">Yes, Validation WG discussions<o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
Here are the changes from v6 that were made in the attached v7:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
1. [In BR 3.2.2.4 introduction]: The CA SHALL confirm that, as of the date the Certificate issues, <<u><span style="background:yellow">is issued</span></u>?><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">"is issued" would be past-tense, implying it's a post-issuance activity, rather than a (pre-)issuance activity - right?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <span style="color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">Then, perhaps this:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:30.8pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">The CA SHALL confirm that
<u>prior to issuance</u></span><u><span style="color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">
</span></u><s><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">as of the date the Certificate issues</span></s><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">,
either the CA or a Delegated Third Party has validated each Fully-Qualified Domain Name (FQDN) listed in the Certificate using at least one of the methods listed below.<o:p></o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="m-7541139769902924714msoplaintext" style="margin-left:30.8pt">2. [In all 10 validation method Notes:] Note: Once the FQDN has been validated using this method, the CA MAY also issue Certificates for other FQDNs that end with all the labels of the
validated FQDN and have <u><span style="background:yellow">the same or</span></u> more labels than it. This method is suitable for validating Wildcard Domain Names.<o:p></o:p></p>
<p class="m-7541139769902924714msolistparagraph" style="margin-left:51.2pt">-<span style="font-size:7.0pt">
</span>The above note appears in multiple places, all need to be updated.<o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">It reads fairly clunky - more was clearer as a numeric comparison, but 'the same or more labels than it' leaves ambiguity as to whether it's equality of the labels (which is handled by the preceding clause).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">Beyond the longstanding concerns about expressing the "Notes" here and their impact on normative expressions, I'm not sure the change is actually necessary - that is, the only FQDN that 'ends with all the labels
of the validated FQDN and has the same number of labels in it' is, well, the FQDN. Is that actually necessary to express - you're saying that after the FQDN has been validated, Certificates may also be issued for the FQDN.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">The current wording avoids this issue, because 'the current FQDN' will never have more labels in it than the current FQDN :)<o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">The point I was trying to make was that the requested FQDN may be identical to the
Validated FQDN, so that it will not have MORE labels, they will be identical labels. The final “it” is not clear<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">Let’s change this:<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:30.8pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">Once the FQDN has been validated using this method, the
CA MAY also issue Certificates for other FQDNs that end with all the labels of the validated FQDN<s> and have the same or more labels than it</s><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
3. [In BR 3.2.2.4.6]: The presence of Required Website Content contained in the content of a file
<s><span style="background:yellow">or on a web page in the form of a meta tag</span>.
</s><we agreed that a web page is a file, so no need><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
4. [In BR 3.2.2.4.6]: Missing “T”: “This method is suitable for validating Wildcard Domain Names.”
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
5. [In BR 3.2.2.4.7]: I’ve commented on this multiple times and I think as written it’s not clear:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
From this:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:6.0pt;margin-left:66.8pt;background:white">
Confirming the Applicant<span style="color:#1F497D">’</span>s control over the FQDN by confirming the presence of a Random Value or Request Token in a DNS CNAME, TXT or CAA record for an Authorization Domain Name or an Authorization Domain Name that is prefixed
with a label that begins with an underscore character.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
To this:<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:66.8pt">
Confirming the Applicant<span style="color:#1F497D">’</span>s control over the FQDN by confirming the presence of a Random Value or Request Token in
<span style="background:yellow">either 1)</span> a DNS CNAME, TXT or CAA record for an Authorization Domain Name or
<span style="background:yellow">2)</span> an Authorization Domain Name that is prefixed with a label that begins with an underscore character.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:30.8pt">
<a name="m_-7541139769902924714__MailEndCompose"></a><o:p> </o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">Kirk,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">Could you highlight where you<span style="color:#1F497D">’</span>ve commented on 3.2.2.4.7 in the past? I want to make sure I better understand your concerns here.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">This was me making comments to the other ballot authors.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">I highlight this because the choice of where to place your either/or is significant. You've placed 1) before the "CNAME, TXT, or CAA record" - which means that 2) can be expressed in any way (for example, an MX
record would be sufficient, it would seem). That certainly doesn't sound correct, but I want to make sure I'm understanding your concerns.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">The alternative way to express this would be reworded as:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">or Request Token in a DNS CNAME, TXT, or CAA record for either:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"> 1) an Authorization Domain Name; or,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt"> 2) an Authorization Domain Name that is prefixed with a label that begins with an underscore character.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">You’re totally right, that is where I meant to put this. There are just too many “or” statements in that requirement to understand it,
thus the need to split it out. I agree with your wording.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:30.8pt">In this case, we make it clear that the Request Token or Random Value still must appear within those record types.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>