<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class=""></div><blockquote type="cite" class=""><div class=""><span style="font-family: Calibri, sans-serif; font-size: 12pt;" class="">This raises a question about the MDSP policy and CAB Forum requirements. Who is the subscriber in the reseller relation? We believe this to be the key holder. However, the language is unclear.</span></div></blockquote><div class=""><br class=""></div><div class="">‘Subscriber’ is a defined term in the BRs:</div><div class="">
<div class="page" title="Page 17">
<div class="layoutArea">
<div class="column"><p class=""><span style="font-size: 10.000000pt; font-family: 'Cambria'; font-weight: 700" class="">Subscriber: </span><span style="font-size: 10.000000pt; font-family: 'Cambria'" class="">A natural person or Legal Entity to whom a Certificate is issued and who is legally bound by a
Subscriber Agreement or Terms of Use.</span></p></div></div></div></div><div class="">That’s pretty clear and can’t be stretched to cover a reseller—a reseller won’t be able to comply with a Subscriber Agreement.</div><div class=""><br class=""></div><div class=""></div><blockquote type="cite" class=""><div class=""><span style="font-family: Calibri, sans-serif; font-size: 16px;" class="">At this time, Trustico has not provided any information about how these certificates were compromised or how they acquired the private keys.</span></div></blockquote><div class=""><br class=""></div><div class="">One question I would have is whether Trustico is in compliance with 6.1.2, "Parties other than the Subscriber SHALL NOT archive the Subscriber Private Key without authorization by the Subscriber.”</div></body></html>