<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Georgia;
panose-1:2 4 5 2 5 4 5 2 3 3;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
h2
{mso-style-priority:9;
mso-style-link:"Heading 2 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:18.0pt;
font-family:"Calibri",sans-serif;
font-weight:bold;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:13.5pt;
font-family:"Calibri",sans-serif;
font-weight:bold;}
h4
{mso-style-priority:9;
mso-style-link:"Heading 4 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.Heading2Char
{mso-style-name:"Heading 2 Char";
mso-style-priority:9;
mso-style-link:"Heading 2";
font-family:"Calibri Light",sans-serif;
color:#2F5496;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Calibri Light",sans-serif;
color:#1F3763;}
span.Heading4Char
{mso-style-name:"Heading 4 Char";
mso-style-priority:9;
mso-style-link:"Heading 4";
font-family:"Calibri Light",sans-serif;
color:#2F5496;
font-style:italic;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Georgia",serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:417749903;
mso-list-template-ids:-1629994622;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1
{mso-list-id:879367553;
mso-list-template-ids:824491302;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2
{mso-list-id:1214273026;
mso-list-template-ids:-1399815632;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3
{mso-list-id:1859394688;
mso-list-template-ids:-8359994;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-family:"Georgia",serif'>Published! In addition, the minutes for 2020-04-16 and 2020-04-30 seem to have disappeared during the site migration, so I restored those posts.<o:p></o:p></span></p><p class=MsoNormal><span style='font-family:"Georgia",serif'><o:p> </o:p></span></p><div><p class=MsoNormal><span style='font-size:9.0pt;font-family:Consolas;color:black'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:9.0pt;font-family:Consolas;color:black'>-- <br>Jos Purvis (</span><a href="mailto:jopurvis@cisco.com"><span style='font-size:9.0pt;font-family:Consolas;color:#954F72'>jopurvis@cisco.com</span></a><span style='font-size:9.0pt;font-family:Consolas;color:black'>)<br>.:|:.:|:. cisco systems | Cryptographic Services<br>PGP: 0xFD802FEE07D19105 | Controls and Trust Verification</span><o:p></o:p></p></div><p class=MsoNormal><span style='font-family:"Georgia",serif'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-family:"Georgia",serif'><o:p> </o:p></span></p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:12.0pt;color:black'>From: </span></b><span style='font-size:12.0pt;color:black'>Servercert-wg <servercert-wg-bounces@cabforum.org> on behalf of CABF Server Cert WG <servercert-wg@cabforum.org><br><b>Reply-To: </b>"Dimitris Zacharopoulos (HARICA)" <dzacharo@harica.gr>, CABF Server Cert WG <servercert-wg@cabforum.org><br><b>Date: </b>Monday, June 1, 2020 at 2:37 PM<br><b>To: </b>CABF Server Cert WG <servercert-wg@cabforum.org><br><b>Subject: </b>[Servercert-wg] Final Minutes for Server Certificate Working Group Teleconference - May 14, 2020<o:p></o:p></span></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal>These are the Final Minutes of the Teleconference described in the subject of this message.<o:p></o:p></p><div><div><h2>Attendees (in alphabetical order)<o:p></o:p></h2><p>Adam Clark (Visa), Arno Fiedler (D-TRUST), Ben Wilson (Mozilla), Bruce Morton (Entrust Datacard), Clint Wilson (Apple), Corey Bonnell (SecureTrust), Chris Kemmerer (SSL.com), Daniela Hood (GoDaddy), Dean Coclin (Digicert), Dimitris Zacharopoulos (HARICA), Doug Beattie (GlobalSign), Dustin Hollenback (Microsoft), Enrico Entschew (D-TRUST), Inaba Atsushi (GlobalSign), Janet Hines (SecureTrust), Jos Purvis (Cisco Systems), Li-Chun Chen (Chunghwa Telecom), Mads Henriksveen (Buypass AS), Michael Guenther (SwissSign), Mike Reilly (Microsoft), Neil Dunbar (TrustCor Systems), Niko Carpenter (SecureTrust), Patrick Nohe (GlobalSign), Pedro Fuentes (OISTE Foundation), Peter Miskovic (Disig), Rich Smith (Sectigo), Robin Alden (Sectigo), Ryan Sleevi (Google), Shelley Brewer (Digicert), Stephen Davidson (Quo Vadis), Taconis Lewis (US Federal PKI Management Authority), Thanos Vrachnos (SSL.com), Tim Hollebeek (Digicert), Tobias Josefowitz (Opera Software AS), Trevoli Ponds-White (Amazon), Wayne Thayer (Mozilla), Wendy Brown (US Federal PKI Management Authority).<o:p></o:p></p><h2>Minutes <o:p></o:p></h2><h3>1. Roll Call<o:p></o:p></h3><p class=MsoNormal>The Chair took attendance. <o:p></o:p></p><h3>2. Read Antitrust Statement<o:p></o:p></h3><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>The Antitrust Statement was read.<o:p></o:p></p><h3>3. Review Agenda, assign minute taker for next meeting<o:p></o:p></h3><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Accepted without changes. Enrico volunteered to take minutes on the next call.<o:p></o:p></p><h3>4. Approval of minutes from previous teleconference<o:p></o:p></h3><p class=MsoNormal>Accepted without objections. <o:p></o:p></p><h3>5. Validation Subcommittee Update<o:p></o:p></h3><p class=MsoNormal>Tim reports that the Subcommittee had a discussion about http responses and which ones should be acceptable or not. Currently some of the 3xx responses allow parsing the content of the body and it might be useful to tighten up these rules with a specific list.<br><br>More discussion on how to present the Certificate Profiles. The best approach they agreed to is the order of appearance in the BRs.<br><br>The draft minutes of that particular Subcommittee meeting are available at the following thread:<o:p></o:p></p><ul type=disc><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1'><a href="https://lists.cabforum.org/pipermail/validation/2020-May/001477.html">https://lists.cabforum.org/pipermail/validation/2020-May/001477.html</a> (please note that this is a side-effect of the transition to the new portal).<o:p></o:p></li></ul><h3>6. NetSec Subcommittee Update<o:p></o:p></h3><p class=MsoNormal>Neil reported that ballot SC28 related to logging and retention policy is in a final draft state. There was also discussion about action "j" related to deactivation of user accounts. The SC is trying to move away from the term "accounts" and introduce the term "access".<br><br>The pain points subgroup discussed about item "2k" which is related to lockout because they identified too many exceptions around that requirement.<br><br>The threat modeling subgroup is drafting a checklist for online CAs. They are working on some text for shared credentials because existing controls are not so precise.<br><br>The subcommittee is also making progress on the remote secure zone terminology and security controls for offline Roots that will be separated.<br><br>The draft minutes of that particular Subcommittee meeting are available at the following thread:<o:p></o:p></p><ul type=disc><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l3 level1 lfo3'><a href="https://lists.cabforum.org/pipermail/netsec/2020-May/000337.html">https://lists.cabforum.org/pipermail/netsec/2020-May/000337.html</a> (please note that this is a side-effect of the transition to the new portal). <o:p></o:p></li></ul><h3 style='mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in'>7. Ballot Status <o:p></o:p></h3><h4><u>Ballots in Discussion Period</u><o:p></o:p></h4><p class=MsoNormal><span style='color:black;border:none windowtext 1.0pt;padding:0in;background:white'>None.<br> </span><br><b><u>Ballots in Voting Period</u></b><br><span style='color:black;border:none windowtext 1.0pt;padding:0in;background:white'>None.</span><br><br><b><u>Ballots in Review Period</u></b><br><i><span style='color:black;border:none windowtext 1.0pt;padding:0in;background:white'>SC29: System Configuration Management (Neil)</span></i><span style='color:black;border:none windowtext 1.0pt;padding:0in;background:white'>.<b> Review period ends 15:00 UTC 7 June 2020</b>.<i> </i></span><o:p></o:p></p><h4 style='mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in'><u>Draft Ballots under Consideration</u><o:p></o:p></h4><p class=MsoNormal><br><i><span style='color:black;border:none windowtext 1.0pt;padding:0in;background:white'>Aligning the BRs with existing Browser Requirements </span></i><span style='color:black;border:none windowtext 1.0pt;padding:0in;background:white'>(Ryan)<br><br>Microsoft will proceed with a number of changes and update requirements to be more permissive. Some of the changes were rolled back because they are no longer part of MS program.<br><br>Mozilla is gathering feedback from CA members.<br><br>Ryan is looking for endorsers. Some requirements are gated on Root programs. Example P521, what is the result if this is not allowed in the BRs? Some Root Programs may have concerns about adding new requirements to their programs.<br><br>CAs need to take a close look at the ballot. Corey commented on name forms.<br><i><br>Spring 2020 cleanup (Ryan)</i><br>One more change was added, the use of CABF OIDs in subCA certificates. May need to clarify this language. Updated the descriptions on GitHub and issues.<br><br>Ryan noted that the ballot adds what seems to be two normative changes which claims they are a natural consequence of existing requirements. <br><br>The first is about CA's that should revoke a Certificate if CP/CPS are violated, but may have some issues with Subscriber Agreements, for example if it's not explicitly stated in the Subscriber Agreement.<br><br>The second is related to 4.9.1.1 which clarifies that if you can derive a private key from a public key, it is a compromized key and this can to be added in 6.1.1.3 for more clarity.<br><br>Tim H. Not the spirit of a cleanup. Ryan responded that this should be a cleanup and clarifications for obviously incorrect language and issues that are already identified.<br><br><i>Disclosures of data sources (Ryan)</i><br>Updated the preamble with feedback from Doug explaining motivation, goals and roadmap. The ballot text was updated and will be discussed on the next validation call. The requirement moved to October instead of September. Also the requirement of keeping the disclosure accessible 24x7 raised concerns about 24x7 and that perhaps the use of a document sharing platform would be prohibited. It's been removed and replaced with "readily accessible and online".<br><br>Originally the disclosure requirement was added in section 8.2.2 of the EV Guidelines but that section was more about disclosing specific CP/CPS OIDs. So, the proposal is to add a new section, 11.1.3 because 11.1 is about verification and this can be coupled nicely.<br><br>Another significant change is that CAs don't need to disclose a given data source if it has not been used to validate a certificate.<br><br>If a CA evaluates and decides not to use, should this be disclosed?<br><br>That is not the intent. It should be disclosed prior to its use and issuance of a Certificate. Compliance teams can evaluate who they want but don't need to disclose if they do not intend to use that source to issue a Certificate. Most feedback has been incorporated. Looking for endorsers and seeing latest changes.<br><br><i>Updating BR Section 6.1.1.3</i><br>Chris: This is related mostly on Debian weak keys and there are some possible overlaps with the cleanup/clarifications ballot. His team will review the best path forward and possible work through the GitHub comments.</span><o:p></o:p></p><h3 style='mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in'>8. Any Other Business<o:p></o:p></h3><p class=MsoNormal>Ben mentioned about OCSP service availability uptime. He asked Members to take a look, respond on the list or contact him, exploring if we should have more specific language around that. Dimitris and Trev recommend this being discussed in the NetSec subcommittee.<br><br>Agenda topics for the upcoming F2F<br>Mostly updates from Browser Members, ETSI, ACAB-c and subcommittees. If anyone wants to discuss a new topic, please come forward.<o:p></o:p></p><h3>9. Next call<o:p></o:p></h3><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>May 28, 2020 at 11:00 am Eastern Time.<o:p></o:p></p><h3>Adjourned<o:p></o:p></h3></div></div><p class=MsoNormal><br><br><o:p></o:p></p></div></body></html>