<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.m5029381910514659697apple-converted-space
{mso-style-name:m_5029381910514659697apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><b>From:</b> Ryan Sleevi [mailto:sleevi@google.com] <br><b>Sent:</b> Friday, September 1, 2017 1:32 PM<br><br></p><div><p class=MsoNormal>Thanks Rich for sharing the added details about when this case comes up.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Is it frequent enough to require the 'fail open' case? Do we believe that security is improved by that - that is, it seems equally likely that if it was 'fail closed" (e.g. deny), then such banks desiring EV certificates can/would lobby RBI to ensure such information is provided, and that seems a positive outcome.<o:p></o:p></p><p class=MsoNormal><b><i>[RWS] I appreciate where you’re coming from with this suggestion, but realistically, it’s not likely to happen and I’d rather we take steps to come up with a reasonable solution to a not entirely uncommon problem if we can. If we absolutely can’t come to agreement on a reasonable solution, I’m fine at that point telling these customers, “Sorry you simply don’t qualify,” but at the end of the day I’d rather see us find a way to issue EVs to legit organizations. I don’t see the point to shutting out a legit segment of the market because we can’t be bothered to try to find a reasonable way to include them.</i></b><o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Understandably, I'd much rather prefer a whitelist to address such situations rather than a blanket exception.<o:p></o:p></p><p class=MsoNormal><b><i>[RWS] I’m OK with that and is what I was trying to get at with my proposed solution. Do you have any specific feedback regarding that? I’ll flesh it out more and turn it into a ballot if we can some to basic terms regarding what we generally want to see happen in an exception case.</i></b><o:p></o:p></p></div></div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On Fri, Sep 1, 2017 at 10:56 AM, Rich Smith via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>To follow up, first, I agree with Ryan that issuance w/out either registration number or registration date is prohibited under current EVG text.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I’d like to see us make some change to the Guidelines to address this because I’ve come across several examples over the years where this has been the case. I think the basic assumption that one or the other would generally be available is generally true for a standard corporate registration, though not in every jurisdiction.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Where I’ve come across this, to the best of my recollection, and as in this case, has been banks and other financial institutions, or possibly insurance companies, and the like where they are registered and administered by government entities other than the standard corporate registries.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>This particular case is a bank in India. Banks in India are registered with and overseen by the Reserve Bank of India. They maintain a list of banks here:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><a href="https://rbi.org.in/scripts/AboutUsDisplay.aspx?pg=RegionalRuralBanks.htm" target="_blank">https://rbi.org.in/scripts/AboutUsDisplay.aspx?pg=RegionalRuralBanks.htm</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>As you can see, they show bank name, address, phone number and website. Our validation agents report that they have contacted the RBI by phone and were unable to obtain the required information.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Possible solution, taking Ryan’s comments to mind:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Change “CA SHALL” to “CA SHOULD”, with additional guidance that exceptions MUST be posted for Forum review/discussion to the Public list no fewer than 7 days prior to issuance. Thereafter, issuance may take place if no member can point out another source from which the required information may be obtained, and the exception will be logged/tracked in an added Appendix to the EVGs<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Thoughts?<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Regards,<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Rich<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b>From:</b> Public [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a>] <b>On Behalf Of </b>Geoff Keating via Public<br><b>Sent:</b> Thursday, August 31, 2017 5:36 PM<br><b>To:</b> Kirk Hall <<a href="mailto:Kirk.Hall@entrustdatacard.com" target="_blank">Kirk.Hall@entrustdatacard.com</a>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br><b>Subject:</b> Re: [cabfpub] EV 11.2.1 Private Organization registration number or date<o:p></o:p></p></div></div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'><o:p> </o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On 31 Aug 2017, at 2:42 pm, Kirk Hall via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Geoff – clearly this applicant will now be denied, but I have to disagree with one of your underlying assumptions below -<span class=m5029381910514659697apple-converted-space> </span>“there is no way to uniquely identify the entity”. Rich Smith of Comodo indicated that the applicant’s corporate registration had been confirmed with the government authority – perhaps based on address or some other identifying factor. Again, when we drafted the EVGL (I think I drafted this particular section), we assumed there would be a registration number or date of registration in all records (we were wrong), but even without that, a CA would have the ability to confirm proper corporate registration tied to the applicant’s unique identity so that identity would be confirmed.<o:p></o:p></p></div></div></blockquote><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Even assuming that there isn’t the possibility of two simultaneous registrations of different entities with the same name (hopefully the government authority prevents this), one question is whether, in future, this entity could dissolve, and a new distinct entity could be created with the same name at the same address. I don’t know what kind of entity we’re talking about, so I don’t know how easy this would be. In some cases, for example partnerships in the US, this happens routinely and frequently.<o:p></o:p></p></div><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:12.0pt'><o:p> </o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I think we should amend EVGL 11.2.1 (1)(c) to allow some other method for recording the confirmation of proper corporate registration. Since Rich knows the facts if this case, I’ll leave it to him to come up with any amending language.<o:p></o:p></p></div></blockquote></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div></div></div></div><p class=MsoNormal style='margin-bottom:12.0pt'><br>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>