<div dir="ltr"><div>This is a useful suggestion, but it doesn't really explain the rationale so much as simply state something without much data.</div><div><br></div><div>Perhaps you could be more concrete in your explanation about why this is important?</div><div><br></div><div>Concretely: If a CA hasn't validated a domain for 398 days, but has within the past 825 days, what specifically is the challenge in validating that domain again. And can you provide data to support it?</div><div><br></div><div>It seems that you're saying it will take a CA approximately one year to revalidate domains, which would be sheer madness, so I'm suspecting there's something very important or misunderstood about your proposal.</div><div><br></div><div>Recall that people were talking about 1 year validation periods 30 years ago, when it was the norm, so concrete data explaining why that's challenging now seems useful.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Dec 3, 2020 at 5:02 PM Bruce Morton via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div class="gmail-m_7605287192946126929WordSection1">
<p class="MsoNormal">Hi Ben,<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">I am thinking that solution could be that effective 1 July 2021, all new verifications could be reused for 398-days AND all previous verifications with reuse expiry periods greater than 398-days would be reduced to 398-days of reuse. This
would remove of 825-days of reuse and also allow the CAs 398-days to re-verify domains. Re-verification is important when the CA provides a service based on pre-validated data. The proposal would also mean that the full solution would be migrated in early
August 2022.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thanks, Bruce.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b>From:</b> Servercert-wg <<a href="mailto:servercert-wg-bounces@cabforum.org" target="_blank">servercert-wg-bounces@cabforum.org</a>>
<b>On Behalf Of </b>Ben Wilson via Servercert-wg<br>
<b>Sent:</b> Wednesday, December 2, 2020 4:55 PM<br>
<b>To:</b> CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>><br>
<b>Subject:</b> [EXTERNAL][Servercert-wg] Reducing Domain/IP Address Validation Reuse to 398 Days<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><strong><span style="font-family:Calibri,sans-serif;color:red">WARNING:</span></strong> This email originated outside of Entrust.<br>
<strong><span style="font-family:Calibri,sans-serif;color:red">DO NOT CLICK</span></strong> links or attachments unless you trust the sender and know the content is safe.<u></u><u></u></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<div>
<div>
<p class="MsoNormal">I am loath to create this thread and to have two simultaneous discussions on the same topic in two different fora, but I want to see if the CA/Browser Forum is willing to incorporate substantially the same 398-day policy, as discussed below,
in its Baseline Requirements and EV Guidelines. <u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">On the Mozilla Dev Security Policy (mdsp) list (<a href="https://groups.google.com/g/mozilla.dev.security.policy/c/7TeSlHFIk5U/m/2ojwLrslBQAJ" target="_blank">https://groups.google.com/g/mozilla.dev.security.policy/c/7TeSlHFIk5U/m/2ojwLrslBQAJ</a>) and
in the Mozilla policy issues list on GitHub (<a href="https://github.com/mozilla/pkipolicy/issues/206" target="_blank">https://github.com/mozilla/pkipolicy/issues/206</a>), Mozilla is considering amending subsection 5 of
<a href="https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/#21-ca-operations" target="_blank">
section 2.1 of the Mozilla Root Store Policy</a> to reduce the reuse of the validation of DNS Names and IP addresses to 398 days.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">Currently, Mozilla is looking at making this requirement effective as of July 1, 2021, with some type of phase-in period, to-be-determined.<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">I intend to draft a ballot that would accomplish that same goal within BR section 4.2.1, and elsewhere as might be necessary in the Baseline Requirements and EV Guidelines.
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal">To prime the discussion here, one issue discussed on the mdsp list is the phase-in, if any, of this 398-day requirement. I have suggested that sunsetting 825-day DNS/IP validations through 2023 is too long, given the validation methods
now available per BR 3.2.2.4 and 3.2.2.5. Would it be simpler just to prohibit, as of 7/1/2021, any reuse of DNS/IP validations older than 398 days?
<u></u><u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
<div>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
</div>
</div>
_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><br>
</blockquote></div></div>