<!DOCTYPE html><html><head><title></title><style type="text/css">#qt p.qt-MsoNormal{margin-top:0in;margin-right:0in;margin-bottom:0in;margin-left:0in;font-size:11pt;font-family:Calibri, sans-serif;}
#qt ul{margin-bottom:0in;}
p.MsoNormal,p.MsoNoSpacing{margin:0}</style></head><body><div>Below are the final minutes for this meeting; these have also been published to the <a href="https://cabforum.org/2022/06/23/2022-06-23-minutes-of-the-server-certificate-working-group/">public website at cabforum.org</a>.<br></div><div><br></div><div>----- Original message -----<br></div><div><br></div><div><b><span style="color:black;">Server Certificate Working Group – 2</span>3 June <span style="color:black;">2022</span></b><br></div><div type="cite" id="qt" style="word-wrap:break-word;"><div class="qt-WordSection1"><div><p style="margin-top:0in;margin-right:0in;margin-bottom:0in;margin-left:0in;"><span style="color:black;">Attendees: </span>Aaron Poulsen (Amazon), Adam Jones (Microsoft), Adrian Mueller (SwissSign), Chris Clements (Google), Chris Kemmerer (SSL.com), Corey Bonnell (Digicert), Daryn Wright (GoDaddy), David Kluge (Google), Dean Coclin (Digicert), Devon O'Brien (Google), Dimitris Zacharopoulos (HARICA), Doug Beattie (GlobalSign), Dustin Hollenback (Microsoft), Emily Stark (Google), Fumi Yoneda (Japan Registry Services), Hubert Chao (Google), Inaba Atsushi (GlobalSign), Inigo Barreira (Sectigo), Jamie Mackey (US Federal PKI Management Authority), Joanna Fox (TrustCor Systems), Jos Purvis (Cisco Systems), Karina Sirota (Microsoft), Kiran Tummala (Microsoft), Lynn Jeun (Visa), Mads Henriksveen (Buypass AS), Martijn Katerbarg (Sectigo), Michelle Coon (OATI), Nargis Mannan (SecureTrust), Paul van Brouwershaven (Entrust), Pedro Fuentes (OISTE Foundation), Peter Miskovic (Disig), Rae Ann Gonzales (GoDaddy), Rebecca Kelley (Apple), Renne Rodriguez (Apple), Stephen Davidson (Digicert), Tadahiko Ito (SECOM Trust Systems), Thomas Zermeno (SSL.com), Trevoli Ponds-White (Amazon), Vijay Kumar (India PKI Forum), Wendy Brown (US Federal PKI Management Authority), Yoshiro Yoneya (Japan Registry Services)<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">1. Read Antitrust Statement</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">Jos Purvis read the antitrust statement.</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">2. Roll Call</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">Dean Coclin read the roll.</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">3. Review Agenda</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">No changes were made to the agenda.</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">4. Approval of Minutes from Last Teleconference</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">No minutes to approve (F2F). Please finish up your F2F minutes and ask for recordings if needed.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">5. Validation Subcommittee Update</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Cory: We went thought the slides that were slated for F2F. Finished review of SHOULD and SHOULD NOT normative changes and also some V2 items. This will continue at the next meeting<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">6. Ballot Status</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">Ballots in Discussion Period</span><br></p><p style="margin-right:0in;margin-bottom:0in;margin-left:1in;text-indent:-0.25in;vertical-align:baseline;"><span style="color:black;"><span class="font" style="font-family:Symbol;"><span class="size" style="font-size:10pt;"><span style="">·<span style="font-style:normal;font-variant-caps:normal;font-weight:normal;font-stretch:normal;line-height:normal;"><span class="font" style="font-family:"Times New Roman";"><span class="size" style="font-size:7pt;"> </span></span></span></span></span></span></span><span style="color:black;">None</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">Ballots in Voting Period</span><br></p><p style="margin-right:0in;margin-bottom:0in;margin-left:1in;text-indent:-0.25in;vertical-align:baseline;"><span style="color:black;"><span class="font" style="font-family:Symbol;"><span class="size" style="font-size:10pt;"><span style="">·<span style="font-style:normal;font-variant-caps:normal;font-weight:normal;font-stretch:normal;line-height:normal;"><span class="font" style="font-family:"Times New Roman";"><span class="size" style="font-size:7pt;"> </span></span></span></span></span></span></span><span style="color:black;">None</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">Ballots in Review Period</span><br></p><p style="margin-right:0in;margin-bottom:0in;margin-left:1in;text-indent:-0.25in;vertical-align:baseline;"><span style="color:black;"><span class="font" style="font-family:Symbol;"><span class="size" style="font-size:10pt;"><span style="">·<span style="font-style:normal;font-variant-caps:normal;font-weight:normal;font-stretch:normal;line-height:normal;"><span class="font" style="font-family:"Times New Roman";"><span class="size" style="font-size:7pt;"> </span></span></span></span></span></span></span><span style="color:black;">None</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">Draft Ballots Under Consideration</span><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;vertical-align:baseline;"><b>Ballot: <span style="color:black;">Debian Weak Keys</span></b><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Chris: There was a suggestion to add Hanno Boeck’s tool to the list of tools that can be used to identity weak keys. Overall happy with the text and we think everything raised that has been addressed. Please take a review and will add Hano’s tool for another options and push it out today.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Dimitris: Chris, about the tool, is this self-controlled so it is not considered a "delegated 3rd party" checking keys for the CA as some sort of remote API? Can anyone check it?</p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Chris: It’s a tool he developed and the link is in the thread and will accept input as sent in. It’s in GitHub.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Ben: We could do a cross reference to a BR web page instead of keeping the list within the BRs itself with a list of suggested tools that can be used, and that would be easier to maintain.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Cory: Since this is a list of suggestions, maybe this guidance is OK to be hosted on the web site.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Dimitris: might want to verify that this has been tested/verified to be accurate, like HARICA verifying Sectigo and vice versa. Even if we suggest this and it’s problematic, we should avoid that.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Jos: Since this is a MAY and contains some suggested links on that page, that would avoid doing changes to that list via ballots each time the repo changes or we need to add new ones. Could still have guidance that CAs need to vet these tools before use.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Chris: Will take the approach for updating the ballot and pointing to a place holder page for now.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Dimitris: Since we don’t have a good process for website updates, and someone could add tools that are not secure, it’s not a good to point to a page in the BRs that can be easily changes which could result in audit problems. We don’t have a process for changing the website, so recommend we do not have the BRs point to the website.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Trev: BRs linking to a page that is not as controlled as the BRs seems like a bad idea. Given we tell customers to use these tools but we don’t have a good security story about that content.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Jos: Yea, good point. So, since this is not managed as strictly as the BRs since there is a list of people that can change the web site without the strict change control as we have for the BRs, suggest not taking this approach. It’s better if we link to the tools directly in the ballot, and then they can be vetted as part of the balloting process. <br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Chris: Will proceed with including the direct links of the suggested tools and they will be vetted as part of the ballot process. Dimitris and Ben agree.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"> <br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;vertical-align:baseline;"><b>Ballot: <span style="color:black;">SLO/Response for CRL & OCSP Responses</span></b><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">David Kluge: No recent updates. Still interested in the ballot. Intermediate conclusion: Key challenge is to define how to properly define the SLOs. Will get some more detail and then will be able to properly process the ballot.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">Please continue discussion on the list.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;">No other ballot updates<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"> <br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">7. Any Other Business</span><br></p><ul style="margin-top:0in;" type="disc"><li style="color:black;margin-top:12pt;margin-bottom:12pt;vertical-align:baseline;"><span style="color:windowtext;">Future of validation committee meetings</span><br></li></ul><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;vertical-align:baseline;">Jos: We had a discussion on the list about the VSC and if we still need it. Welcome discussion like we had and looks forward to having more technical topics on the calls like we had earlier in this meeting vs. just a status as well as the mailing list.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;vertical-align:baseline;">As far as the future, no reason to change anything immediately, but welcome more discussions.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;vertical-align:baseline;">As we expand the discussion of this call we may want to potentially moving the forum call to a monthly call and that would provide more time to this WG/SC.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;vertical-align:baseline;">Dimitris: Should move this to the public list. VSC is still improving validation methods and practices and have not completed that work yet. Share the concerns with the time issues just raised.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;vertical-align:baseline;">Jos: Let’s continue these technical discussions during these calls vs .just status updates.<br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">8. Next call: </span>July 7<sup>th</sup><br></p><p style="margin-right:0in;margin-bottom:12pt;margin-left:0in;"><span style="color:black;">Adjourn; Immediately convene meeting of CA Browser Forum (same call)</span><br></p><p class="qt-MsoNormal"> <br></p></div></div><div>_______________________________________________<br></div><div>Management mailing list<br></div><div><a href="mailto:Management@cabforum.org">Management@cabforum.org</a><br></div><div><a href="https://lists.cabforum.org/mailman/listinfo/management">https://lists.cabforum.org/mailman/listinfo/management</a><br></div><div><br></div></div><div><br></div></body></html>