<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style=""><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Is it possible that we try to align sections 5.4 and 5.5 with </span><span style="display: inline !important; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">RFC
3647 to avoid confusion?</span></div>
<div style=""><span style="display: inline !important;"><br>
</span></div>
<div style=""><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Where 5.4 is intended to record the audit log, as in who, what, when, and where (but without the actual content).</span></div>
<div style=""><a href="https://www.rfc-editor.org/rfc/rfc3647.html#section-4.5.4" id="LPlnk"><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">https://www.rfc-editor.org/rfc/rfc3647.html#section-4.5.4</span></a><br>
</div>
<div contenteditable="false"></div>
<div style=""><br>
</div>
<div style=""><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">The introduction of BR section 5.4.1 currently states: "including all information generated and documentation received in connection with the
certificate request", which should fall under section 5.5 according to </span><span style="display: inline !important; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">RFC 3647.</span></div>
<div style=""><br>
</div>
<div style=""><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Section 5.5.1 of the BR currently has no clear definition of what needs to be archived and leans on 5.5.2 which conflicts with 5.4.3 based
on the description of 5.4.1. </span></div>
<div style=""><br>
</div>
<div style=""><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">We might also want to consider including audit records, CRL's, CP/CPS documents, etc. under 5.5.1.</span></div>
<div style=""><br>
</div>
<div style=""><span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">Paul</span></div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Servercert-wg <servercert-wg-bounces@cabforum.org> on behalf of Neil Dunbar via Servercert-wg <servercert-wg@cabforum.org><br>
<b>Sent:</b> Wednesday, December 9, 2020 11:37<br>
<b>To:</b> CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org><br>
<b>Subject:</b> [EXTERNAL][Servercert-wg] Ballot SC38 - Alignment of Record Archival</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">WARNING: This email originated outside of Entrust.<br>
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.<br>
<br>
This begins the discussion period for Ballot SC38: Alignment of Record <br>
Archival (which I circulated a little while ago).<br>
<br>
The following ballot is proposed by Neil Dunbar of TrustCor Systems and <br>
endorsed by David Kluge of Google Trust Services and Ben Wilson of Mozilla.<br>
<br>
Purpose of Ballot:<br>
<br>
After the updated language included in SC28 Sections 5.4.3 and 5.5.2 (of <br>
the BRs) could be in conflict. Section 5.5.2 requires all documentation <br>
relating to certificate requests and the verification thereof, and all <br>
Certificates and revocation thereof be retained for seven years after <br>
certificates cease to to be valid. Section 5.4.3 requires all audit logs <br>
of Subscriber Certificate lifecycle management event records be <br>
maintained for two years after the revocation or expiration of the <br>
Subscriber Certificate. These sections intersect at the retention <br>
requirements for audit logs and archived records, as they relate to <br>
subscriber certificate lifecycle events. The retention periods are in <br>
conflict as to the length of retention.<br>
<br>
The proposed changes seek to bring these two sections of the “Baseline <br>
Requirements” into agreement and avoid confusion and potential issues of <br>
noncompliance as they relate to retention periods.<br>
<br>
The NetSec discussion document for this ballot is attached as a PDF to <br>
this email.<br>
<br>
-- MOTION BEGINS --<br>
<br>
Delete the following Section 5.5.2 Retention period for archive from the <br>
“Baseline Requirements for the Issuance and Management of <br>
Publicly-Trusted Certificates”, which currently reads as follows:<br>
<br>
The CA SHALL retain all documentation relating to certificate requests <br>
and the verification thereof, and all Certificates and revocation <br>
thereof, for at least seven years after any Certificate based on that <br>
documentation ceases to be valid.<br>
Insert, as Section 5.5.2. Retention period for archive of the “Baseline <br>
Requirements for the Issuance and Management of Publicly-Trusted <br>
Certificates”, the following:<br>
<br>
The CA SHALL retain all documentation relating to certificate requests <br>
and the verification thereof, and all Certificates and revocation <br>
thereof, for at least two years after any Certificate based on that <br>
documentation ceases to be valid.<br>
<br>
-- MOTION ENDS --<br>
<br>
* WARNING *: USE AT YOUR OWN RISK. THE REDLINE BELOW IS NOT THE OFFICIAL <br>
VERSION OF THE CHANGES (CABF Bylaws, Section 2.4(a)):<br>
<br>
A comparison of the changes can be found at: <br>
<a href="https://github.com/cabforum/documents/compare/8f63128...neildunbar:180341b">https://github.com/cabforum/documents/compare/8f63128...neildunbar:180341b</a><br>
<br>
This ballot proposes one Final Maintenance Guideline.<br>
<br>
The procedure for approval of this ballot is as follows:<br>
<br>
Discussion: (7+ days)<br>
Start Time: 2020-12-09 17:00 UTC<br>
End Time: not before 2020-12-16 17:00 UTC<br>
<br>
Vote for approval: (7 days)<br>
Start Time: TBD<br>
End Time: TBD<br>
<br>
</div>
</span></font></div>
</body>
</html>