<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Jan 19, 2018 at 1:51 AM, Mads Egil Henriksveen via Public <span dir="ltr"><<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="NO-BOK" link="#0563C1" vlink="#954F72">
<div class="m_-3814159789841328240WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d">Hi
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d">Buypass, Entrust Datacard and GlobalSign have been working on some text to strengthen 3.2.2.4.1 instead of removing it - find the draft text below. The draft was discussed
in the Validation Working Group meeting yesterday. We would like to offer this as an amendment to Ballot 218.
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d">We (and some other CAs as well) are concerned about the short transition period in Ballot 218. In order to change systems, validation procedures etc. we believe any transition
period should be at least 10 weeks (as long as the security risk exposed is low).
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d">Regards<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d">Mads
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d"><u></u> <u></u></span></p>
<p class="m_-3814159789841328240MsoNormalCxSpMiddle" style="margin-bottom:8.0pt;line-height:105%">
<b><span lang="EN-GB">3.2.2.4.1 Validating the Applicant as a Domain Name Registrant</span></b><b><span lang="EN-GB" style="font-size:12.0pt;line-height:105%;font-family:"Times New Roman",serif"><u></u><u></u></span></b></p>
<p class="MsoNormal"><span lang="EN-GB">Conforming the Applicant's control over the FQDN by validating the Applicant as the Domain Name Registrant by verifying that:
<u></u><u></u></span></p>
<p class="m_-3814159789841328240MsoListParagraphCxSpFirst" style="margin-right:0cm;margin-bottom:8.0pt;margin-left:54.0pt;line-height:105%">
<u></u><span lang="EN-GB"><span>1.<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN-GB">The name of the Domain Name Registrant matches the Applicant’s name AND<u></u><u></u></span></p>
<p class="m_-3814159789841328240MsoListParagraphCxSpMiddle" style="margin-right:0cm;margin-bottom:8.0pt;margin-left:54.0pt;line-height:105%">
<u></u><span lang="EN-GB"><span>2.<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN-GB">Additional information about the Domain Name Registrant in the WHOIS meet the following requirements:<u></u><u></u></span></p>
<p class="m_-3814159789841328240MsoListParagraphCxSpMiddle" style="margin-right:0cm;margin-bottom:8.0pt;margin-left:69.6pt;line-height:105%">
<u></u><span lang="EN-GB"><span><span style="font:7.0pt "Times New Roman"">
</span>i.<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u><span lang="EN-GB">The Registrant’s postal address in the WHOIS belongs to the Applicant. CAs MUST verify this by matching it with one of the Applicant's addresses
in: (a) a QGIS, QTIS, or QIIS; or (b) a Verified Professional Letter. <br>
Note: Address details in the WHOIS are required to use this option. Address details must include at a minimum the Country and either Locality, State or Province. OR
<u></u><u></u></span></p>
<p class="m_-3814159789841328240MsoListParagraphCxSpLast" style="margin-right:0cm;margin-bottom:8.0pt;margin-left:69.6pt;line-height:105%">
<u></u><span lang="EN-GB"><span><span style="font:7.0pt "Times New Roman"">
</span>ii.<span style="font:7.0pt "Times New Roman""> </span></span></span><u></u><span lang="EN-GB">The WHOIS contains the Registration (or similar) Number assigned to the Applicant by the Incorporating or Registration Agency in its Jurisdiction
of Incorporation or Registration as appropriate. CAs MUST verify this by matching the Registration Number in the WHOIS with the Applicant’s Registration Number in a QGIS or a QTIS.
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Additionally, this method may only be used if:
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">1. The CA authenticates the Applicant's identity under BR Section 3.2.2.1 and the authority of the Applicant Representative under BR Section 3.2.5, OR<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">2. The CA authenticates the Applicant's identity under EV Guidelines Section 11.2 and the agency of the Certificate Approver under EV Guidelines Section 11.8; OR
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">3. The CA is also the Domain Name Registrar, or an Affiliate of the Registrar, of the Base Domain Name.
<span style="color:#5b9bd5"><u></u><u></u></span></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">Note: Once the FQDN has been validated using this method, the CA MAY also issue Certificates for other FQDNs that end with all the labels of the validated FQDN. This method is suitable for validating Wildcard Domain Names.<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-GB">This revised version of BR 3.2.2.4.1 shall apply to domain validations occurring on or after June 1, 2018.</span></p></div></div></blockquote><div><br></div><div>As Geoff has noted, this substantially weakens the requirements, to a level unacceptable and non-equivalent to the existing methods. It also apparently fails to understand both the underlying risks and concerns.</div><div><br></div><div>While I appreciate Buypass, Entrust, and GlobalSign working on such text, I'll note that it lacks the necessary assurances, and also lacks the necessary information to mitigate the risk for site operators.</div><div><br></div><div>Such certificates issued under these conditions should not be considered trustworthy, as they do not provide assurance for domain control. <br></div></div><br></div></div>