<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Thanks Ryan. You’ve answered my questions and your responses are aligned to my expectations for our trusted CAs. I had some questions come up related to your comments in GitHub on this ballot so I posted here to ensure clarity for folks.
Thanks, Mike<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Ryan Sleevi <rsleevi@chromium.org> <br>
<b>Sent:</b> Monday, August 9, 2021 11:54 AM<br>
<b>To:</b> Mike Reilly (SECURITY) <Mike.Reilly@microsoft.com><br>
<b>Cc:</b> CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org>; Ryan Sleevi <rsleevi@chromium.org>; Corey Bonnell <Corey.Bonnell@digicert.com><br>
<b>Subject:</b> Re: [EXTERNAL] [Servercert-wg] SC48 and case sensitivity of CN and SAN value encoding<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left" width="100%" style="width:100.0%">
<tbody>
<tr>
<td style="background:#A6A6A6;padding:5.25pt 1.5pt 5.25pt 1.5pt"></td>
<td width="100%" style="width:100.0%;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 11.25pt">
<div>
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#212121">You don't often get email from
</span><span style="color:black"><a href="mailto:rsleevi@chromium.org"><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif">rsleevi@chromium.org</span></a></span><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#212121">.
</span><span style="color:black"><a href="http://aka.ms/LearnAboutSenderIdentification"><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif">Learn why this is important</span></a></span><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#212121"><o:p></o:p></span></p>
</div>
</td>
<td width="75" style="width:56.25pt;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 3.75pt;align:left">
</td>
</tr>
</tbody>
</table>
<div>
<div>
<p class="MsoNormal">Hey Mike, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm not fully sure I understand the question. Are you asking "Will Chrome enforce the Baseline Requirements on locally-trusted CAs"?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I think you can see that the respective root programs, of all the browser members, have taken such situations on a case-by-case basis; for example, I believe Apple was the vendor who most recently introduced such changes ( <a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.apple.com%2Fen-us%2FHT210176&data=04%7C01%7CMike.Reilly%40microsoft.com%7C5120be373344425829c808d95b6711a3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637641320510556051%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=hhnZSvmBU3FD5LfQpsjGT9UPE2e1LBby78in7kiMeF8%3D&reserved=0">https://support.apple.com/en-us/HT210176</a>
)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">But they generally haven't had any bearing to the discussions in the CA/B Forum regarding the adoption or interpretation of existing requirements.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">That is, I should hope to say it's uncontroversial to say a certificate that doesn't comply with the BRs, issued by a CA subject to the BRs, is misissuance, regardless of how an application treats it. Similarly, I think it's uncontroversial
to point out that our respective applications may reject certificates that are not misissuance, or may make distinction between BR-subjected CA issuance and non-BR-subjected CA issuance.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">The comparison to CT doesn't really make sense, because that's not a BR requirement. The language of "character by character copy" is very much a part of the BRs (at least, post IP review). While it doesn't really seem relevant to the Forum,
on the Chrome side, we've haven't really offered enterprise policies to "ignore the BRs from CAs subject to the BRs", and I doubt that's likely to change anytime soon.<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Mon, Aug 9, 2021 at 2:46 PM Mike Reilly (SECURITY) <<a href="mailto:Mike.Reilly@microsoft.com">Mike.Reilly@microsoft.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><a href="mailto:rsleevi@chromium.org" target="_blank"><span style="text-decoration:none">@Ryan Sleevi</span></a> will this position by Google Chrome to considered such certificates
to be mis-issued be applicable for certs issued by Private (Managed/Enterprise) CAs as well? I do understand that this forum is for public CAs but if Chrome is enforcing this in its browser, then like CT, it won’t work for Private CAs. Since there is a setting
provided by Chrome for CT for private CAs, will there eventually be the same capability for this scenario for private CAs? Thanks, Mike<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b>From:</b> Servercert-wg <<a href="mailto:servercert-wg-bounces@cabforum.org" target="_blank">servercert-wg-bounces@cabforum.org</a>>
<b>On Behalf Of </b>Corey Bonnell via Servercert-wg<br>
<b>Sent:</b> Friday, August 6, 2021 5:45 AM<br>
<b>To:</b> CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>><br>
<b>Subject:</b> [EXTERNAL] [Servercert-wg] SC48 and case sensitivity of CN and SAN value encoding<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Hello,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">A question on the GitHub PR for SC48 [1] pointed out that the language surrounding acceptable encoding of CN values is not clear whether case mismatches of the SAN dNSName and CN
value are allowed. The conclusion of that discussion is that at least one Root Program will view such case mismatches as mis-issuance. It appears that there may be several CAs impacted by this, so I wanted to alert the group in case this is unexpected for
those CAs.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Corey<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">[1]
<a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcabforum%2Fservercert%2Fpull%2F285%23discussion_r683444000&data=04%7C01%7CMike.Reilly%40microsoft.com%7C5120be373344425829c808d95b6711a3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637641320510566039%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=acBs11Xk4ILS1Gjwr3auZpXyf%2BjFVfCe8lpudpTFtcw%3D&reserved=0" target="_blank">
https://github.com/cabforum/servercert/pull/285#discussion_r683444000</a><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>