<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>An inquiry was posted to the questions@ mailer regarding reconciling the conflict between the two-year (825-day) maximum validity period in the Baseline Requirements and the recently announced change to Apple’s Root Program limiting certificates to one year (398 days). In particular, this prompted the question of what root programs consider “misissuance” (which may carry additional penalties up to and including distrust) versus “we simply won’t trust certificates that don’t conform to this”, which seemed like a valuable discussion for the public mailer.<o:p></o:p></p><p class=MsoNormal style='margin-top:12.0pt'>As the person charged with responding to the questions@ list, I drafted a response and sent it to the private CABF list for edits before sending back to the questioner. In my response, I stated that a cert issued after 1 Sept 2020 would not be trusted in Apple products and I also essentially said that Apple would <u>not</u> treat this as a violation which could result in penalties toward the CA that issued such a cert. I was quickly corrected and pointed to the minutes from the F2F meeting (<a href="https://cabforum.org/2020/03/20/minutes-for-ca-browser-forum-f2f-meeting-49-bratislava-19-20-february-2020/#Apple-Root-Program-Update">https://cabforum.org/2020/03/20/minutes-for-ca-browser-forum-f2f-meeting-49-bratislava-19-20-february-2020/#Apple-Root-Program-Update</a>) that in fact it would be treated as a policy violation, meaning that Apple could impose certain penalties (up to and including distrust) on any CA that issued a publicly trusted cert in excess of 398 days after September 1<sup>st</sup>. <o:p></o:p></p><p class=MsoNormal><br>Apparently, I was not the only one that was unclear on this as other forum members (who also attended the F2F) chimed in with similar comments. Unfortunately this discussion happened on the CABF private email list and reposting is discouraged by our bylaws. Hence this new discussion topic. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Actually I’m not sure there’s much to discuss here. I only post this because there are likely people outside of the Forum that are also unclear on Apple’s mandate. The Support article (<a href="https://support.apple.com/en-us/HT211025">https://support.apple.com/en-us/HT211025</a>) only contains technical details related to implementation and does not discuss policy considerations. The Apple ppt at the F2F (<a href="https://cabforum.org/wp-content/uploads/11-Apple-Root-Program-Update.pdf">https://cabforum.org/wp-content/uploads/11-Apple-Root-Program-Update.pdf</a>) is also silent on this topic. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>So to sum this up, according to Apple, if a publicly trusted CA issues a TLS certificate with a validity period greater than 398 days after September 1, 2020, not only will it not be trusted in Apple products (technically enforced in late 2020) but Apple will treat this as a policy violation and an incident which may result in a CA’s root certificate being distrusted.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>