<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 3/1/2018 9:21 μμ, Tim Hollebeek via
Public wrote:<br>
</div>
<blockquote type="cite"
cite="mid:DM5PR14MB128985055ADB2A0EDED90BD1831E0@DM5PR14MB1289.namprd14.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Ballot 218: Remove validation methods #1
and #5<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Purpose of Ballot: Section 3.2.2.4 says
that it “defines the permitted processes and procedures for
validating the Applicant’s ownership or control of the
domain.” Most of the validation methods actually do validate
ownership and control, but two do not, and can be completed
solely based on an applicant’s own assertions.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Since these two validation methods do not
meet the objectives of section 3.2.2.4, and are actively being
used to avoid validating domain control or ownership, they
should be removed, and the other methods that do validate
domain control or ownership should be used.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The following motion has been proposed by
Tim Hollebeek of DigiCert and endorsed by Ryan Sleevi of
Google and Rich Smith of Comodo.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-- MOTION BEGINS –<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">This ballot modifies the “Baseline
Requirements for the Issuance and Management of
Publicly-Trusted Certificates” as follows, based upon Version
1.5.4:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In Section 3.2.2.4.1, add text at the end:
“For certificates issued on or after March 1, 2018, this
method SHALL NOT be used for validation, and completed
validations using this method SHALL NOT be used for the
issuance of certificates.”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In Section 3.2.2.4.5, add text at the end:
“For certificates issued on or after March 1, 2018, this
method SHALL NOT be used for validation, and completed
validations using this method SHALL NOT be used for the
issuance of certificates.”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none">In Section
4.2.1, after the paragraph that begins “After the change to
any validation method”, add the following paragraph:
“Validations completed using methods specified in Section
3.2.2.4.1 or Section 3.2.2.4.5 SHALL NOT be re-used on or
after March 1, 2018.”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-- MOTION ENDS –<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">For the purposes of section 4.2.1, the new
text added to 4.2.1 from this ballot is “specifically provided
in a [this] ballot.”<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The procedure for approval of this ballot
is as follows:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Discussion (7+ days) <o:p></o:p></p>
<p class="MsoNormal"> Start Time: 2017-01-03 19:30:00 UTC <o:p></o:p></p>
<p class="MsoNormal"> End Time: Not Before 2017-01-10 19:30:00
UTC<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Vote for approval (7 days) <o:p></o:p></p>
<p class="MsoNormal"> Start Time: TBD <o:p></o:p></p>
<p class="MsoNormal"> End Time: TBD<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<br>
This is the current text of 3.2.2.4.1:<br>
<br>
--- BEGIN QUOTE ---
<h5>3.2.2.4.1 Validating the Applicant as a Domain Contact</h5>
<p>Confirming the Applicant's control over the FQDN by validating
the Applicant is the Domain Contact directly with the Domain Name
Registrar. This method may only be used if:</p>
<ol>
<li>The CA authenticates the Applicant's identity under BR Section
3.2.2.1 and the authority of the Applicant Representative under
BR Section 3.2.5, OR</li>
<li>The CA authenticates the Applicant's identity under EV
Guidelines Section 11.2 and the agency of the Certificate
Approver under EV Guidelines Section 11.8; OR</li>
<li>The CA is also the Domain Name Registrar, or an Affiliate of
the Registrar, of the Base Domain Name.
Note: Once the FQDN has been validated using this method, the CA
MAY also issue Certificates for other FQDNs that end with all
the labels of the validated FQDN. This method is suitable for
validating Wildcard Domain Names.</li>
</ol>
<p>--- END QUOTE ---<br>
</p>
<p>Methods 3.2.2.4.2 and 3.2.2.4.3 rely on publicly available
(usually WHOIS) information about domain registrants which are
usually provided by public suffix registries. There are cases
(like the gr public suffix domains) where domain registrant
information is not publicly available. The only method of
acquiring information of domain registrants is to contact the
Registrar.</p>
<p>Our proposal to the the ballot proposer and endorsers is to
update method 3.2.2.4.1 instead of completely removing it, so
that:<br>
</p>
<ol>
<li>it MUST NOT be used for domains that have publicly-available
domain registrant information, which can be validated directly
via method 3.2.2.4.2 OR 3.2.2.4.3. <br>
</li>
<li>for the restricted public suffix registry cases, allow the CA
to obtain Domain Registrant information directly with the Domain
Name Registrar, which will then MUST be combined with method
3.2.2.4.2 OR 3.2.2.4.3.</li>
</ol>
<p>We would also like to keep option 3, in cases where the CA is
also the Domain Name Registrar of the Base Domain Name to reduce
unnecessary duplication of work.</p>
<p>Please consider the following language:</p>
<p>--- BEGIN updated language for 3.2.2.4.1 ---<br>
</p>
<p>Confirming the Applicant's control over the FQDN by validating
the Applicant is the Domain Contact directly with the Domain Name
Registrar. This method may only be used if:</p>
<ol>
<li>The CA validates Domain Contact information obtained from the
Domain Registrar by using the process described in section
3.2.2.4.2 OR 3.2.2.4.3; OR<br>
</li>
<li>The CA is also the Domain Name Registrar, or an Affiliate of
the Registrar, of the Base Domain Name.</li>
</ol>
Note: Once the FQDN has been validated using this method, the CA MAY
also issue Certificates for other FQDNs that end with all the labels
of the validated FQDN. This method is suitable for validating
Wildcard Domain Names.<br>
<br>
--- END updated language for 3.2.2.4.1 ---<br>
<br>
<br>
Best regards,<br>
Dimitris.<br>
</body>
</html>