<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US">Dear all,<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Regular review of documents is an important good practice to detect outdated, inconsistent or no-longer compliant stuff. IMHO such a review still requires human attention and can’t be fully automated. The more frequent
such a review has to be done, the higher the risk of fatigue and oversight. More frequent reviews also increases cost.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">On the other side, if a review has to be done simply to increase the version number, add a line to the history-table, sign and publish the document again, then it can be fully automated. Such an automation would of course
defeat the original intention of a review but couldn’t be detected by an outsider unless she/he would do a manual review…
</span><span lang="EN-US" style="font-family:"Segoe UI Emoji",sans-serif">😉</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">There are public documents (e.g. CPs) that are oftne not affected by BR or root store policy changes. For such documents I fail to see a benefit of more frequent reviews.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">It would be great if we can come up with (out-of-the-box) ideas about how to increase the overall document “quality” supporting the security of the ecosystem while at the same time not creating purely administrative overhead.
</span><span lang="EN-US" style="font-family:"Segoe UI Emoji",sans-serif">😊</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US">Kind regards<br>
Roman<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Servercert-wg <servercert-wg-bounces@cabforum.org>
<b>On Behalf Of </b>Ryan Dickson via Servercert-wg<br>
<b>Sent:</b> Dienstag, 15. November 2022 19:25<br>
<b>To:</b> Ben Wilson <bwilson@mozilla.com>; CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org><br>
<b>Subject:</b> Re: [Servercert-wg] Annual Update of CPS<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">[Accidentally posted this in the
<a href="https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgroups.google.com%2Fa%2Fmozilla.org%2Fg%2Fdev-security-policy%2Fc%2FJoyItinU9iQ%2Fm%2F0QECoxA2CAAJ%3Futm_medium%3Demail%26utm_source%3Dfooter&data=05%7C01%7Croman.fischer%40swisssign.com%7C830d1133093a43ea7df608dac736aff9%7C21322582607f404c82d950ddb1eca5c9%7C1%7C0%7C638041334953818772%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=fLKxuqNvSECRbpi14bBmXrAfjqyfBkbwLELoBzRIfAU%3D&reserved=0">
MDSP</a> thread related to the same topic, sorry if you're seeing this twice!]</span><o:p></o:p></p>
<p style="margin:0cm"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">Hi all,</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">I commented on the GitHub</span><a href="https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcabforum%2Fservercert%2Fissues%2F370%23issuecomment-1315408729&data=05%7C01%7Croman.fischer%40swisssign.com%7C830d1133093a43ea7df608dac736aff9%7C21322582607f404c82d950ddb1eca5c9%7C1%7C0%7C638041334953818772%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=RTxhSULWRU2MTkxiDF%2B5yxIWX0Q2WCwASnN8ajCIfOA%3D&reserved=0" target="_blank"><span style="font-family:"Arial",sans-serif;color:#0E101A">
</span><span style="font-family:"Arial",sans-serif;color:#4A6EE0">issue</span></a><span style="font-family:"Arial",sans-serif;color:#0E101A">, but if we're looking at changing this requirement, I think we should do so from the perspective of making it better
aligned with root program expectations. </span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">Many root program policies include the expectation that a CA's policies conform with the latest version of the BRs. Over the past five years, we've seen, on average, eight ballots
adopted to modify the BRs each year. While it's true that not all ballots necessitate a CA's policies are updated, I suspect if we studied it closer, we'd probably see CAs would need to update their CP a few times a year, on average, to satisfy root program
policies that require policy “freshness.”</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">I'm not strongly proposing we change the yearly minimum requirement but instead expressing concern about
<i>increasing</i> it beyond every 365 days.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">Somewhat related, I think some simple improvements could be made regarding file naming conventions on policy documents to make it easier for CAs to demonstrate compliance with
policy “freshness” requirements.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">For example, assume we required the current version of a CP always to be located at [$ca_repository_base_url]/cp.pdf], or an otherwise static URL. As new versions of the CP are
published, they would replace the document hosted at [$ca_repository_base_url]/cp.pdf] or the static URL. "Archived" versions would then be appended with the version # of the then superseded document (e.g., a superseded document would transition from [$ca_repository_base_url]/cp.pdf]
to [$ca_repository_base_url]/cp-[$previousVersion].pdf]). Ultimately, this makes it very easy for interested parties to find the most current version of a given document.
</span><o:p></o:p></p>
<p style="margin:0cm"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">The same format can apply to CPSs or TSPSs. To accommodate CAs that maintain multiple CPs, we’ll need to think about ways of differentiating URLs.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">Root programs interested in doing so (or CCADB) could then monitor the "current" policy document URLs and more easily verify the update requirement has been met (i.e., regularly
curl and hash $ca_repository_base_url]/cp.pdf, and report when a policy is about to or has recently become stale). Thinking beyond the immediate capabilities of CCADB, perhaps someday it could automatically track version changes to policy documents as they
are identified by changes to the hashed value of $ca_repository_base_url]/cp.pdf - reducing workload required by CAs to make sure CCADB records are accurate and updated in a timely manner. </span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">And, while we’re thinking outside the box - would requiring policy documents be maintained in a common format that easily supports diffs and tracked changes (i.e., Markdown, as
we maintain the BRs) - improve our collective policy management and conformance efforts?</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">Thanks,</span><o:p></o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:#0E101A">Ryan</span><o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Nov 15, 2022 at 11:01 AM Ben Wilson via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal">Hi Clint,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">On second thought, maybe my mind has changed about this. I invite others to chime in.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Ben<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Nov 15, 2022 at 7:16 AM Clint Wilson <<a href="mailto:clintw@apple.com" target="_blank">clintw@apple.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal">Hi Ben,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Can you share more of your reasoning for picking 398 days and in general for decreasing the frequency of CP/CPS update requirements?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks!<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">-Clint<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Nov 14, 2022, at 4:38 PM, Ben Wilson via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal">All,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Section 2.3 of the Baseline Requirements currently says, "The CA SHALL develop, implement, enforce, and annually update a Certificate Policy<br>
and/or Certification Practice Statement that describes in detail how the CA implements the latest version of these Requirements." I am considering a proposal to revise that language to specify a 398-day period. See
<a href="https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcabforum%2Fservercert%2Fissues%2F370%23issuecomment-1113441809&data=05%7C01%7Croman.fischer%40swisssign.com%7C830d1133093a43ea7df608dac736aff9%7C21322582607f404c82d950ddb1eca5c9%7C1%7C0%7C638041334953818772%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=bSkArOdQpVNvWi%2F%2BVQzDK7ZoScNt8Dhsp7as2ClRkag%3D&reserved=0" target="_blank">
https://github.com/cabforum/servercert/issues/370#issuecomment-1113441809 <br>
</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Possible language would be:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">"The CA SHALL develop, implement, enforce, and <s>annually</s> update a Certificate Policy and/or Certification Practice Statement that describes in detail how the CA implements the latest version of these Requirements. The CA SHALL indicate
conformance with this requirement by incrementing the version number and adding a dated changelog entry
<u>at least every 398 days</u>, even if no other changes are made to the document."<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Ben<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fmailman%2Flistinfo%2Fservercert-wg&data=05%7C01%7Croman.fischer%40swisssign.com%7C830d1133093a43ea7df608dac736aff9%7C21322582607f404c82d950ddb1eca5c9%7C1%7C0%7C638041334953818772%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=qVVdJl679az9ikfZEbpTQqmhEFjxfQPgdQvoWn4faFU%3D&reserved=0" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal">_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fmailman%2Flistinfo%2Fservercert-wg&data=05%7C01%7Croman.fischer%40swisssign.com%7C830d1133093a43ea7df608dac736aff9%7C21322582607f404c82d950ddb1eca5c9%7C1%7C0%7C638041334953818772%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=qVVdJl679az9ikfZEbpTQqmhEFjxfQPgdQvoWn4faFU%3D&reserved=0" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</div>
</body>
</html>