<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.gmail-m-1668814377043980290msolistparagraph, li.gmail-m-1668814377043980290msolistparagraph, div.gmail-m-1668814377043980290msolistparagraph
{mso-style-name:gmail-m_-1668814377043980290msolistparagraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle20
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:455297433;
mso-list-template-ids:2136141650;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>I’m a little bit surprised to see no other opinions here.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Yes, you followed my logic correctly: adoption of ISO 3166-2 for the ST= field would make the answer to this question unambiguous (in the negative; i.e. AP is prohibited).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>In the absence of such a clear standard, we must look elsewhere. I don’t think the comment about “dead drops” is helpful, and seems to be trying to make a false equivalence. As I noted in my background, these addresses exist to increase the level of assurance for mail delivery to these addresses, which is kind of the opposite.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I still think that going forward, ISO 3166-2 is the best right answer for a clear, bright line about what belongs in the ST= field, but this one was brought up internally as an interesting case, since the United States has formalized these codes at the same level as the postal codes for US states, and they cover areas that are US territory but are <o:p></o:p></p><p class=MsoNormal>not covered by an ISO 3166-2 code. I thought it was an interesting point, and wanted to hear what others thought.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>-Tim<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Ryan Sleevi <sleevi@google.com> <br><b>Sent:</b> Friday, June 19, 2020 10:51 AM<br><b>To:</b> Tim Hollebeek <tim.hollebeek@digicert.com>; CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org><br><b>Subject:</b> Re: [Servercert-wg] Correct state and locality for US army post offices<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Fri, Jun 19, 2020 at 10:31 AM Tim Hollebeek via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>A quick question for you all, since the baseline requirements are unclear here.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>For those unfamiliar with addresses for US foreign military bases and diplomatic posts, they look something like this:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Somepersonplaceorthing XXX<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Miltary unit / box / whatever<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>APO AE 12345<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>See also: <a href="https://faq.usps.com/s/article/How-Do-I-Address-Military-Mail" target="_blank">https://faq.usps.com/s/article/How-Do-I-Address-Military-Mail</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>These locations intentionally do not use foreign city / state codes to avoid having their mail routed through foreign mail <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>systems, and in some cases because the location is US soil and/or not subject to foreign jurisdiction anyway. These locations<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>even have US zipcodes assigned. For example, 962xx is actually in Korea, and is associated with the two letter postal<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>code AP. For example, the US embassy in Seoul has the following US mailing address:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>US Embassy Seoul<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Unit #9600<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>DPO AP 96209<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>The question is what is the best practice for converting such an address to C=, L=, ST= format. Options include:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><ol start=1 type=1><li class=gmail-m-1668814377043980290msolistparagraph style='mso-list:l0 level1 lfo1'>C=US, L=APO AP, ST=(none) [ST can be omitted if L is present]<o:p></o:p></li><li class=gmail-m-1668814377043980290msolistparagraph style='mso-list:l0 level1 lfo1'>C=US, L=APO, ST=AP [using official postal code as ST]<o:p></o:p></li><li class=gmail-m-1668814377043980290msolistparagraph style='mso-list:l0 level1 lfo1'>other?<o:p></o:p></li></ol><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I think it’s pretty clear that (1) complies with the BRs. The question is whether (2) does. The ST field is defined as<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>“state or province information”, but we know from previous discussions that it is not strictly limited to things named<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>“states” or “provinces”, as it can also include functionally similar political subdivisions like Swiss cantons. The question<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>is whether having a US postal code and official two letter postal abbreviation means that AP, AE, and AA are legal<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>values of the ST field.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Of course, this question would be easy to answer if my suggestion to use ISO 3166-2 as the official list of valid ST fields<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>had been adopted, but unfortunately there didn’t seem to be much support for it.<o:p></o:p></p></div></div></blockquote><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Specifically, the adoption of ISO 3166-2 would have prohibited ST=AP because AP is not a recognized division within ISO 3166-2 for US, correct?<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>And this is specifically in the context of whether the verification of address in 3.2.2.1 uses postal routing as the determinant for address of existence, right?<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Here's a different way of thinking about this example: Would there be any concern if, for example, a Subscriber applied for an OV certificate, and the Subscriber provided a "utility bill, bank statement, credit card statement, government-issued tax document, or other form of identification that the CA determines to be reliable", with that information going to a mail forwarding service / virtual mailbox? <o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Obviously, this would be a massively different level of assurance than "A site visit by the CA or a third party who is acting as an agent for the CA;", but both scenarios are permitted by 3.2.2.1.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>If a CA has issues with Subscribers using such "dead drops", then it would seem they should have similar trouble with respect to the above example. Alternatively, if there's no trouble with the above example, then there should be no trouble with the use of such routing services. <o:p></o:p></p></div></div></div></div></div></body></html>