<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:TimesNewRomanPSMT;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:0in;
line-height:106%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
p.line867, li.line867, div.line867
{mso-style-name:line867;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;
color:black;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<b><span style="font-size:12.0pt;font-family:"Arial",sans-serif">NOTICE OF REVIEW PERIOD – BALLOT 214<o:p></o:p></span></b></p>
<p class="MsoNormal" align="center" style="margin-bottom:0in;margin-bottom:.0001pt;text-align:center;line-height:normal">
<b><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></b></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:12.0pt;font-family:"Arial",sans-serif">This Review Notice is sent pursuant to Section 4.1 of the CA/Browser Forum’s Intellectual Property Rights Policy (v1.2). This Review Period is for Final Maintenance Guidelines (30 day Review Period).
</span><span style="font-size:12.0pt;font-family:TimesNewRomanPSMT">A complete draft of the Draft Guideline that is the subject of this Review Notice is attached.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:12.0pt;font-family:"Arial",sans-serif">Date Review Notice Sent: September 27, 2017<u><o:p></o:p></u></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:12.0pt;font-family:"Arial",sans-serif">Ballot for Review: Ballot 214 – CAA Discovery CNAME Errata<u><o:p></o:p></u></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal">
<u><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p><span style="text-decoration:none"> </span></o:p></span></u></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:12.0pt;font-family:"Arial",sans-serif">Start of Review Period: September 27, 2017 at 23:00 UTC<u><o:p></o:p></u></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal">
<u><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p><span style="text-decoration:none"> </span></o:p></span></u></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal">
<span style="font-size:12.0pt;font-family:"Arial",sans-serif">End of Review Period: October 27, 2017 at 23:00 UTC<u><o:p></o:p></u></span></p>
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.25in;margin-bottom:.0001pt;line-height:normal">
<u><span style="font-size:12.0pt;font-family:"Arial",sans-serif"><o:p><span style="text-decoration:none"> </span></o:p></span></u></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:12.0pt;font-family:"Arial",sans-serif">Please forward any Exclusion Notice relating to Essential Claims to the Chair by email to
</span><a href="mailto:kirk.hall@entrustdatacard.com"><span style="font-size:12.0pt;font-family:"Arial",sans-serif">kirk.hall@entrustdatacard.com</span></a><span style="font-size:12.0pt;font-family:"Arial",sans-serif"> before the end of the Review Period.
See current version of CA/Browser Forum Intellectual Property Rights Policy for details.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<span style="font-size:12.0pt;font-family:TimesNewRomanPSMT"><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<i><span style="font-family:"Arial",sans-serif">(Optional form of Exclusion Notice is attached)<o:p></o:p></span></i></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:normal;text-autospace:none">
<i><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></i></p>
<p class="line867" style="margin:0in;margin-bottom:.0001pt"><strong><span style="font-family:"Arial",sans-serif">Ballot 214 – CAA Discovery CNAME Errata</span><o:p></o:p></strong></p>
<p class="line867" style="margin:0in;margin-bottom:.0001pt"><strong><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;font-weight:normal"><o:p> </o:p></span></strong></p>
<p class="line867" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">-- MOTION BEGINS --<br>
<br>
In the Baseline Requirements v1.4.9 Section 3.2.2.8. CAA Records<br>
<br>
Strike:<br>
<br>
As part of the issuance process, the CA MUST check for a CAA record for each dNSName in the subjectAltName extension of the certificate to be issued, according to the procedure in RFC 6844, following the processing instructions set down in RFC 6844 for any
records found. If the CA issues, they MUST do so within the TTL of the CAA record, or 8 hours, whichever is greater.<br>
<br>
Replace with:<br>
<br>
As part of the issuance process, the CA MUST check for CAA records and follow the processing instructions for any records found, for each dNSName in the subjectAltName extension of the certificate to be issued, as specified in RFC 6844 as amended by Errata
5065 (Appendix A). If the CA issues, they MUST do so within the TTL of the CAA record, or 8 hours, whichever is greater.<br>
<br>
<br>
In the Baseline Requirements ADD an Appendix A that reads:<br>
<br>
Appendix A -- RFC6844 Errata 5065<br>
<br>
The following errata report has been held for document update for RFC6844, "DNS Certification Authority Authorization (CAA) Resource Record".<br>
<br>
--------------------------------------<br>
You may review the report below and at:<br>
<a href="http://www.rfc-editor.org/errata/eid5065">http://www.rfc-editor.org/errata/eid5065</a><br>
<br>
--------------------------------------<br>
Status: Held for Document Update<br>
Type: Technical<br>
<br>
Reported by: Phillip Hallam-Baker <<a href="mailto:philliph@comodo.com">philliph@comodo.com</a>> Date Reported: 2017-07-10 Held by: EKR (IESG)<br>
<br>
Section: 4<br>
<br>
Original Text<br>
-------------<br>
Let CAA(X) be the record set returned in response to performing a CAA<br>
record query on the label X, P(X) be the DNS label immediately above<br>
X in the DNS hierarchy, and A(X) be the target of a CNAME or DNAME<br>
alias record specified at the label X.<br>
<br>
o If CAA(X) is not empty, R(X) = CAA (X), otherwise<br>
<br>
o If A(X) is not null, and R(A(X)) is not empty, then R(X) =<br>
R(A(X)), otherwise<br>
<br>
o If X is not a top-level domain, then R(X) = R(P(X)), otherwise<br>
<br>
o R(X) is empty.<br>
<br>
Corrected Text<br>
--------------<br>
Let CAA(X) be the record set returned in response to performing a CAA<br>
record query on the label X, P(X) be the DNS label immediately above<br>
X in the DNS hierarchy, and A(X) be the target of a CNAME or DNAME<br>
alias record chain specified at the label X.<br>
<br>
o If CAA(X) is not empty, R(X) = CAA (X), otherwise<br>
<br>
o If A(X) is not null, and CAA(A(X)) is not empty, then R(X) =<br>
CAA(A(X)), otherwise<br>
<br>
o If X is not a top-level domain, then R(X) = R(P(X)), otherwise<br>
<br>
o R(X) is empty.<br>
<br>
Thus, when a search at node X returns a CNAME record, the CA will<br>
follow the CNAME record chain to its target. If the target label<br>
contains a CAA record, it is returned.<br>
<br>
Otherwise, the CA continues the search at<br>
the parent of node X.<br>
<br>
</span> <span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Note that the search does not include the parent of a target of a<br>
CNAME record (except when the CNAME points back to its own path).<br>
<br>
To prevent resource exhaustion attacks, CAs SHOULD limit the length of<br>
CNAME chains that are accepted. However CAs MUST process CNAME<br>
chains that contain 8 or fewer CNAME records.<br>
<br>
--Motion Ends--<br>
<br>
</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>