<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>I think some people might have objections to “includes, but not limited to…” language, but I don’t. I think it’s sometimes helpful when drafting intentionally broad criteria like this to make it explicitly clear that common cases like “WebTrust for CAs” or “ETSI …” is indeed “relevant to the issuance of S/MIME certificates”. That could really cut down on the amount of confusion about who does or does not qualify for membership, and give members clarity when voting for the charter about who is and isn’t allowed to participate, while also potentially allowing participation by others with less common audit schemes.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>That’s just a more verbose than usual way of me saying that yes, I would appreciate draft text along the lines you suggest.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>-Tim<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Ryan Sleevi <sleevi@google.com> <br><b>Sent:</b> Wednesday, April 22, 2020 3:15 PM<br><b>To:</b> Tim Hollebeek <tim.hollebeek@digicert.com><br><b>Cc:</b> CABforum1 <public@cabforum.org><br><b>Subject:</b> Re: [cabfpub] Update about S/MIME Charter<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>See my earliest comments on the first draft about this - <a href="https://cabforum.org/pipermail/public/2019-January/014517.html">https://cabforum.org/pipermail/public/2019-January/014517.html</a> shows the suggested edit and points to <a href="https://cabforum.org/pipermail/public/2019-January/014521.html">https://cabforum.org/pipermail/public/2019-January/014521.html</a><o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal>Finally, regarding membership criteria, I'm curious whether it's necessary<br>to consider WebTrust for CAs / ETSI at all. For work like this, would it<br>make sense to merely specify the requirements for a CA as one that is<br>trusted for and actively issues S/MIME certificates that are accepted by a<br>Certificate Consumer. This seems to be widely inclusive and can be iterated<br>upon if/when improved criteria are developed, if appropriate.<br>There's also a bootstrapping issue for membership, in that until we know<br>who the accepted Certificate Consumers are, no CA can join as a Certificate<br>Issuer. I'm curious whether it makes sense to explicitly bootstrap this in<br>the charter or how we'd like to tackle this.<o:p></o:p></p></blockquote><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>In the current incarnation, it's to simply remove the scheme requirement, as follows:<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal>A Certificate Issuer eligible for voting membership in the SMCWG MUST have a publicly-available audit report or attestation statement in accordance with a publicly-available audit or assessment scheme relevant to the issuance of S/MIME certificates. This includes, but is not limited to, ...:<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Happy to propose draft text to this effect, if this is something that you're open to addressing.<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Wed, Apr 22, 2020 at 3:03 PM Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com">tim.hollebeek@digicert.com</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Unintentional, and thanks for calling it out. I don’t have strong feelings on the issue and agree broader participation is a useful goal, especially before requirements exist. Certificate Consumers can, and I expect will, have their own opinions on what audits are appropriate and necessary once they adopt the requirements. Do you have a proposed fix?<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>-Tim<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b>From:</b> Ryan Sleevi <<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>> <br><b>Sent:</b> Sunday, April 19, 2020 4:41 PM<br><b>To:</b> Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com" target="_blank">tim.hollebeek@digicert.com</a>>; CABforum1 <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br><b>Subject:</b> Re: [cabfpub] Update about S/MIME Charter<o:p></o:p></p></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Looking through the resolved and unresolved aspects, the lack of feedback from you meant we still have one unaddressed matter in the draft:<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><a href="https://github.com/cabforum/documents/pull/167/files#r392389077" target="_blank">https://github.com/cabforum/documents/pull/167/files#r392389077</a><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>- The proposed draft charter forbids any CA from participating unless they already have particular audit schemes, despite this document not yet existing nor being incorporated into audit frameworks. This has been repeatedly raised as an issue for the past year, and it would be useful to know whether or not this is intentionally not being addressed. It does seem that there doesn't need to be restrictions on CA membership until such a document is produced (see also <a href="https://cabforum.org/pipermail/public/2020-March/014917.html" target="_blank">https://cabforum.org/pipermail/public/2020-March/014917.html</a> )<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div></div></div></div></div></blockquote></div></div></div></body></html>