<div dir="ltr">I'd love a little more information on this difficulty.<br><br><div>The standard crontab syntax has never supported "perform this task every X months" even for X <= 12; it has only ever supported "perform this task in months X,Y, and Z", where those are integers representing January through December. You can say something <i>that looks like</i> "do this every 12 months", but that actually means "do this in months <i>divisible by 12</i>", i.e. every December.</div><div><br></div><div>A task to update CRLs which is scheduled to occur every Jan 1st abides by the new requirements (once every 367 days) just as easily as it abided by the old requirements (once every 12 months).<br></div><div><br></div><div>Just because a requirement is specified to the precision of seconds does not mean that the systems which abide by that requirement need to be specified at the same precision -- they simply need to abide by it. A process which occurs every 11 months will trivially abide by a 367-day requirement, no matter what level of precision those months are measured to.</div><div><br></div><div>Aaron</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Dec 15, 2021 at 5:06 AM Wendy Brown - QT3LB-C via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">although not a voting member - I agree with Dimitiris <br clear="all"><div><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><p><span style="font-family:"Segoe Script",sans-serif">Wendy</span></p>
<p><span style="font-size:12.8px">Wendy Brown<br></span><span style="font-size:12.8px">Supporting GSA FPKI<br></span><span style="font-size:12.8px">Protiviti Government
Services</span></p>
<p> 703-965-2990 (cell)</p>
<p><a href="mailto:wendy.brown@gsa.gov" style="font-size:12.8px" target="_blank">wendy.brown@gsa.gov</a><br><a href="mailto:wendy.brown@protiviti.com" style="font-family:Calibri,sans-serif" target="_blank">wendy.brown@protiviti.com</a></p></div></div></div></div></div></div></div></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Dec 15, 2021 at 12:51 AM Dimitris Zacharopoulos (HARICA) via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<br>
HARICA disagrees with adding the following text to the Baseline
Requirements:<br>
<br>
<i><span><span>"**Effective
2022-06-01:**</span> For purposes of computing differences, a
difference of 3,600 seconds shall be equal to one hour, and a
difference of 86,400 seconds shall be equal to one day, ignoring
leap seconds. Any amount of time greater than this, including
fractional seconds, shall represent an additional unit of
measure, such as an additional hour or additional day."</span></i><br>
<br>
My team has advised me that when using the standard (vixie) cron, an
admin cannot state that an action must take place:<br>
<ul>
<li>every x minutes, for x>60</li>
<li>every x hours, for x>24</li>
<li>every x days, for x>1</li>
<li>every x months, for x>12</li>
</ul>
An admin would need to create custom scripts to overcome these
problems, thus creating a possibility of human error. It is also not
possible to specify seconds. This is just one of the tools that can
be used by admins. Windows has the same limitations in the "tasks"
scheduling tool.<br>
<br>
This is a very simple indication that such a change in the
requirements will require significant analysis and implementation
effort by all CAs without good justification.<br>
<br>
HARICA still doesn't see a clear benefit from generalizing the
expectation that all time intervals in the BRs, EVGs, NetSec should
be evaluated at the level of 1 second which is an "expensive"
compliance obligation and should be applied/enforced in areas where
it is really needed. The necessity may come from interoperability
risks as we have seen for the validity of certificates and OCSP/CRL.
If other areas seem appropriate for this level of accuracy, we
should identify, justify and add to the requirements instead of
making a general requirement for such an expensive operation.<br>
<br>
<br>
Dimitris.<br>
<br>
<div>On 2/12/2021 5:20 μ.μ., Tim Hollebeek
via Servercert-wg wrote:<br>
</div>
<blockquote type="cite">
<div>
<p class="MsoNormal">Ballot SC-52 version 2: Specify CRL
Validity Intervals in Seconds<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Purpose of Ballot: Similar to Ballot SC-31
which modified the specification of<u></u><u></u></p>
<p class="MsoNormal">OCSP validity periods to be in seconds,
this ballot modifies the specification<u></u><u></u></p>
<p class="MsoNormal">of CRL validity periods to be in seconds to
avoid confusion about exactly which<u></u><u></u></p>
<p class="MsoNormal">periods are valid and which are not. The
ballot also specifies that other time <u></u><u></u></p>
<p class="MsoNormal">periods should be handled the same way,
which has broader impacts throughout <u></u><u></u></p>
<p class="MsoNormal">the document.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">These changes should not be interpreted as
implying that missing a deadline by<u></u><u></u></p>
<p class="MsoNormal">a few seconds is any more or less important
than it previously was. The<u></u><u></u></p>
<p class="MsoNormal">changes are merely intended to provide
additional clarity and precision about<u></u><u></u></p>
<p class="MsoNormal">exactly where the deadlines are.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The following motion has been proposed by
Tim Hollebeek of DigiCert and endorsed <u></u><u></u></p>
<p class="MsoNormal">by Trevoli Ponds-White of Amazon and Kati
Davids of GoDaddy.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">---MOTION BEGINS---<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This ballot modifies the “Baseline
Requirements for the Issuance and Management <u></u><u></u></p>
<p class="MsoNormal">of Publicly-Trusted Certificates”
(“Baseline Requirements”), based on Version 1.8.0:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">MODIFY the Baseline Requirements as
specified in the following Redline:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><a href="https://github.com/cabforum/servercert/compare/cda0f92ee70121fd5d692685b97ebb6669c74fb7...2b9cf93af71233095f370cdc1d1b587166da4b07" target="_blank">https://github.com/cabforum/servercert/compare/cda0f92ee70121fd5d692685b97ebb6669c74fb7...2b9cf93af71233095f370cdc1d1b587166da4b07</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">---MOTION ENDS---<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">This ballot proposes a Final Maintenance
Guideline. <u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The procedure for approval of this ballot
is as follows: <u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Discussion (7+ days)<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Start Time: December 2, 2021 10:30 am
Eastern<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">End Time: No earlier than December 9, 2021
10:30 am Eastern<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Vote for approval (7 days)<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">Start Time: TBD<u></u><u></u></p>
<p class="MsoNormal"> <u></u><u></u></p>
<p class="MsoNormal">End Time: TBD<u></u><u></u></p>
</div>
<br>
<fieldset></fieldset>
<pre>_______________________________________________
Servercert-wg mailing list
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a>
</pre>
</blockquote>
<br>
</div>
_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><br>
</blockquote></div>
_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><br>
</blockquote></div>