<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On 3 Nov 2017, at 2:37 pm, Peter Bowen via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><div class=""></div></blockquote>…<br class=""><blockquote type="cite" class=""><div class=""><div class="">From the discussion on the list, I propose that we explicitly exclude countryName from Subject Identity Information. As Geoff pointed out, historically some DV certs have included countryName and there is a process in the BRs for validation of countryName when it is the only item in the subject.<br class=""><br class="">What do others think? Is it reasonable to allow DV certificates with countryName in the subject?<br class=""></div></div></blockquote></div><br class=""><div class="">I guess it should also be mentioned that if you use the process in the BRs, you’re not really validating that the countryName is the country of the subscriber; in this case the countryName is the country of a domain name or IP address. It’ll be a country associated with the subscriber but not necessarily the subscriber's home. So I think it would be reasonable to exclude it from Subject Identity Information.</div><div class=""><br class=""></div><div class="">If we were up for some editing, I think it should be ‘Subscriber Identity Information’, though, not ‘Subject’. The BRs are a bit confused about what a Subject might be:</div><div class=""><br class=""></div><div class=""></div><blockquote type="cite" class=""><div class="">Subject: The natural person, device, system, unit, or Legal Entity identified in a Certificate as the Subject. The Subject is either the Subscriber or a device under the control and operation of the Subscriber.</div></blockquote><div class=""><br class=""></div><div class="">… so, in a certificate with CN=<a href="http://www.example.com/O=example" class="">www.example.com/O=Example</a> Inc./C=US, is the Subject ‘Example Inc.’, or ‘<a href="http://www.example.com" class="">www.example.com</a>’, and if the second, why is ‘<a href="http://www.example.com" class="">www.example.com</a>’ not Subject Identity Information, and if the first, then what is the Subject for ‘CN=<a href="http://www.example.com" class="">www.example.com</a>’?</div><div class=""><br class=""></div></body></html>