<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:x="urn:schemas-microsoft-com:office:excel" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
p.m8736879794240613020msolistparagraph, li.m8736879794240613020msolistparagraph, div.m8736879794240613020msolistparagraph
{mso-style-name:m_8736879794240613020msolistparagraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Final Minutes for CA/Browser Forum Teleconference – August 31, 2017 (approved Sept. 14, 2017)<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Attendees: <span lang="EN" style="color:black">Arno Fiedler (</span>D-TRUST<span lang="EN" style="color:black">), Atsushi Inaba (GlobalSign), Ben Wilson (DigiCert),
</span><span style="color:black">Christopher Kemmerer (SSL.com), Curt Spann (Apple), Dean Coclin (Symantec),
</span><span lang="EN">Devon O’Brien (Google), Dimitris </span>Zacharopoulos (HARICA),
<span lang="EN" style="color:black">Doug Beattie (GlobalSign), Frank Corday (Trustwave), Geoff Keating (Apple), Gervase Markham (Mozilla), JC Jones (Mozilla), Jeff Ward (WebTrust), Jeremy Rowley (DigiCert), Ken Myers (US FPKI), Kirk Hall (Entrust), Leo Grove
(SSL.com), Li-Chun Chen (Chunghwa Telecom), </span>Mads Henriksveen (BuyPass), <span lang="EN" style="color:black">
Neil Dunbar (TrustCor), Peter Bowen (Amazon), Peter Miscovic (Disig), Rick Andrews (Symantec), Robin Alden (Comodo), Tim Hollebeek (Trustwave), Tim Shirley (Trustwave),
</span>Virginia Fournier (Apple), <span lang="EN" style="color:black">Wayne Thayer (GoDaddy), Wendy Brown (US FPKI), Zhihui Liang (360),</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%">1. Roll Call<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%">2. Read Antitrust Statement <o:p>
</o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%">3. Review Agenda. Agenda was approved.<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%">4. Approve Minutes of teleconference of August 17, 2017. The minutes were approved and will be posted to the Public list.<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%">5. Governance Change Working Group. Dean said the WG had met this week and reviewed the draft FAQ that will be circulated. It also reviewed Gerv’s extensive and helpful comments, and will complete those revisions
on the next call. The WG hopes to have a ballot ready for voting in September. Kirk asked if the WG was also drafting an initial new Working Group Charter (e.g., Server Certificate Working Group) to take over the work of the current Forum if the Ballot passes.
Dean said yes, a new charter was being prepared in the standard format. He said the WG had also discussed if the members of all the new Working Groups would have a seat at the Forum level, and the answer appears yes with voting at the Forum level likely to
be CAs in one group and non-CAs in a second group.<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%">6. Policy Review Working Group update. Ben said there had been a WG call that morning, working on the definition of “Certification Authority” in the BRs using a combination of ETSI and ISO definitions. He also
mentioned the use of the term Trust Service Provider, and Kirk asked if we already have a definition for that. Dimitris said yes, as included in ISO 21188 which is referenced by WebTrust for CAs. In general, CA might be the term used for the more technical
systems and operators for issuing and revoking certificates, while Trust Service Providers could be used for recognizing that a party could operate multiple CAs with different policies. Kirk asked if the goal of the WG is to modify the BRs to be clearer on
the use of terms, but not otherwise to change any rules, and the answer was yes.<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%">7. Network Security Working Group update. Ben said he had taken the list of 13 possible changes and improvements to the current NetSec requirements and posted them to an online survey where WG members could
rate the issues in order of importance, and he discussed the results. The top priorities were to clarify the use and definition of “Root CA” and which of the NetSec requirements should apply to them (especially when the Root CA is offline). The definitions
need to be reworked. Kirk asked if the WG’s plan was to work on one issue at a time and get to a proposed solution before moving to the next issue, and Ben said generally yes (assuming it didn’t take too long to fix each problem). He noted that some issues
overlap and have dependencies, which will require a coordinated approach. <o:p>
</o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%">8. Validation Working Group update. No report (but see Ballot Status discussion).<o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal" style="line-height:105%">9. Restart of Ballot 190 v7 (<span style="border:none windowtext 1.0pt;padding:0in;background:white">BR 3.2.2.4 Validation Methods). Kirk noted he had proposed a restart of Ballot 190 on the Public list, which
had been delayed waiting for new BR definitions in Ballot 202 that could be used in Ballot 190. Because Ballot 202 had failed (over minor issues that can be fixed) and no new definitions ballot has been filed, it was time to get Ballot 190 finished so the
revised BR 3.2.2.4 validation methods would be passed, then immediately start on improvements. Gerv suggested the formal discussion period not start until after the US Labor Day holiday on Sept. 4 so that members would focus on the final ballot, and Kirk
agreed.</span><o:p></o:p></p>
<p class="MsoNormal" style="line-height:105%"><o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in;line-height:105%">
10. Ballot Status.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in;line-height:105%">
<o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in;line-height:105%">
Ballot 211 - <strong><span style="font-family:"Calibri",sans-serif;color:black;background:white;font-weight:normal">Resolution of Approval for WTCA v2.1 Changes. Jeff said the WebTrust Task Force wanted “vetting” by Forum members of their proposal for changes
to WebTrust for CAs (Sec. 4.5-4.10) concerning key destruction, transportation, etc., and appreciated the useful comments from Forum members. He recognized that the Forum generally wants to “own” any standards it endorses, and said the Task Force had decided
the WTCA changes probably should not be formally approved by the Forum as they applied both to public and private CAs. Accordingly, the Task Force was no longer asking the Forum for formal approval. Kirk said that the related Ballot 211 would be withdrawn.<o:p></o:p></span></strong></p>
<p class="MsoNormal" style="mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in;line-height:105%">
<strong><span style="font-family:"Calibri",sans-serif;color:black;background:white;font-weight:normal"><o:p> </o:p></span></strong></p>
<p class="m8736879794240613020msolistparagraph" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<strong><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;color:black;background:white;font-weight:normal">Ballots 207-209 - ASN.1 Jurisdiction in EV Guidelines, dnQualifiers, EV Liability. Dean asked when these ballots were going
to move forward. Jeremy said they were all ready, and would start soon. Kirk suggested Ballot 209 on EV Liability might generate more discussion and so maybe should start after the other two.<o:p></o:p></span></strong></p>
<p class="m8736879794240613020msolistparagraph" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<strong><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;color:black;background:white;font-weight:normal"><o:p> </o:p></span></strong></p>
<p class="m8736879794240613020msolistparagraph" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<strong><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;color:black;background:white;font-weight:normal">Draft Revocation Ballot – Jeremy said he was seeking endorsers for his draft ballot changing the current BRs (BR 4.9.1.1
and 4.9.5) on time deadlines for responding to problem reports and revocation requests, as the current rules don’t work when minor, non-security related issues are reported to a CA. A blanket response time of 24 hours for non-critical issues did not leave
enough time to contact the customer, provide a replacement cert (which the customer needed to install), and revoke the prior certificate. He believes the permitted period for critical security issues (e.g., revocation after the customer reports key compromise)
should remain at 24 hours, but that other non-critical revocation issues should have up to 7 days to complete a response.
<o:p></o:p></span></strong></p>
<p class="m8736879794240613020msolistparagraph" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<strong><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;color:black;background:white;font-weight:normal"><o:p> </o:p></span></strong></p>
<p class="m8736879794240613020msolistparagraph" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<strong><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;color:black;background:white;font-weight:normal">Gerv noted the rules require some sort of initial response in the first 24 hours, but a complete response might take longer
(gathering information, etc.). Peter agreed that some investigation could take a long time. Kirk asked what would happen if the CA contacted the customer for information on a non-critical issue, and the customer didn’t respond back in 7 days. Jeremy said
the CA should document that it “could not determine” if the certificate should be revoked due to lack of response, and then the CA should probably close the file.<o:p></o:p></span></strong></p>
<p class="m8736879794240613020msolistparagraph" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<strong><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;color:black;background:white;font-weight:normal"><o:p> </o:p></span></strong></p>
<p class="m8736879794240613020msolistparagraph" style="margin:0in;margin-bottom:.0001pt;line-height:105%">
<strong><span style="font-size:11.0pt;line-height:105%;font-family:"Calibri",sans-serif;font-weight:normal">Kirk noted the proposal had language requiring reporting to the Forum concerning some revocation requests, but thought it was better if the CA simply
responds to the person who filed a problem report - if the problem was reported to the CA via a public list on Mozilla, etc. the person could share the CA’s response there. Jeremy agreed that some issues would not be appropriate for public disclosure. Gerv
noted that some revocation issues arguably involve “misissuance” by the CA (using that term loosely), and said he had written and circulated a “best practices” document for CAs on the most effective way to make public disclosure of such issues. Tim said he
agreed that CAs shouldn’t be required to report problems in applying the revocation response rules back to the Forum – if there is a problem with the rules in the BRs, the CA is extremely likely to bring the issue back to the Forum anyway. Kirk agreed.</span></strong><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in;text-indent:-.95pt;line-height:105%">
<o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in;line-height:105%">
11. Any Other Business. There was no other business. Kirk suggested members send him agenda ideas for the upcoming F2F meeting in Taipei in October. Doug noted the group hotel had told him the cancellation policy was two days before the meeting, not an
earlier date as previously reported.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in;line-height:105%">
<o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in;line-height:105%">
12. Next call Sept. 14, 2017<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in;line-height:105%">
<o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in;line-height:105%">
13. Adjourn<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.35pt;text-indent:-.95pt;line-height:105%">
<o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>