<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:"Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe Script";
panose-1:3 11 5 4 2 0 0 0 0 3;}
@font-face
{font-family:"\@Yu Gothic";
panose-1:2 11 4 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I agree with Wendy’s assertion that superseded isn’t the most appropriate reasonCode for “The Certificate no longer complies with the requirements of [Section 6.1.5](#615-key-sizes) and [Section 6.1.6](#616-public-key-parameters-generation-and-quality-checking) (CRLReason #4, superseded)”. If we’re doing something drastic as, say, banning RSA-2048 that most certainly means that those keys are now suspect and can no longer be trusted. Although the “weakAlgorithm”/”weEkalgorithm” reasonCode in later versions of X.509 would be more appropriate, I think that “keyCompromise” would be the most appropriate code defined in RFC 5280/X.509 2005-08.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Thanks,<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Corey<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Servercert-wg <servercert-wg-bounces@cabforum.org> <b>On Behalf Of </b>Aaron Gable via Servercert-wg<br><b>Sent:</b> Wednesday, February 1, 2023 3:02 PM<br><b>To:</b> Tim Hollebeek <tim.hollebeek@digicert.com><br><b>Cc:</b> CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org><br><b>Subject:</b> Re: [Servercert-wg] Discussion Period Begins: Ballot SC-061v3: New CRL Entries must have a Revocation Reason Code<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>For better or worse, RFC 5280 says nothing about the meanings of the various revocation reasons, other than their names. X.509 itself (<a href="https://avanan.url-protection.com/v1/url?o=https%3A//www.itu.int/rec/T-REC-X.509-201910-I/en&g=ODI2NDBiZDYyNTJjMDQ5YQ==&h=OTJhN2RiNGNhYmI1MjI4NTYzMDVmNGRlMzY4MmZhZDNlMzEyMzI2ZTQwNjQ3MTA0YmZiNGY2ZjA3ZjM2Y2ZhYg==&p=YXAzOmRpZ2ljZXJ0OmE6bzo1Mjk0YmM0NGRlZGRhNzY2ODJlMTEyMDczNDkzYmE4Yjp2MTpoOkY=" title="Protected by Avanan: https://www.itu.int/rec/T-REC-X.509-201910-I/en">https://www.itu.int/rec/T-REC-X.509-201910-I/en</a>) has this to say:<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal>The following reason code values indicate why a public-key certificate was revoked:<br>– unspecified can be used to revoke public-key certificates for reasons other than the specific codes.<br>– keyCompromise is used in revoking an end-entity public-key certificate; it indicates that it is known or<br>suspected that the subject's private key, or other aspects of the subject validated in the public-key<br>certificate, have been compromised.<br>– cACompromise is used in revoking a CA certificate; it indicates that it is known or suspected that the<br>subject's private key, or other aspects of the subject validated in the CA certificate, have been<br>compromised.<br>– affiliationChanged indicates that the subject's name or other information in the public-key certificate<br>has been modified but there is no cause to suspect that the private key has been compromised.<br>– superseded indicates that the public-key certificate has been superseded but there is no cause to suspect<br>that the private key has been compromised.<br>– cessationOfOperation indicates that the public-key certificate is no longer needed for the purpose for<br>which it was issued but there is no cause to suspect that the private key has been compromised.<br>– privilegeWithdrawn indicates that a public-key certificate was revoked because a privilege contained<br>within that public-key certificate has been withdrawn.<br>– aACompromise is only relevant for ACRL entries (see 17.2.3.1).<br>– weekAlgorithm indicates that the public-key certificate was revoked due to a weak cryptographic<br>algorithm and/or key (e.g., due to short key length or unsafe key generation).<o:p></o:p></p></blockquote><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Aaron <o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Wed, Feb 1, 2023 at 11:36 AM Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com">tim.hollebeek@digicert.com</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Well, if Mozilla policy is wrong, we shouldn’t do the wrong thing just because it’s already in Mozilla policy. It just needs we would need a bit of coordination with Mozilla to fix it. However I don’t believe that’s necessary.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>If you read the highlighted section Wendy posted, it’s pretty clear that RFC 5280 explicitly intends for superseded to be (mis)used in this manner. Only the first unhighlighted part before the first “or” requires a request for a new certificate.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I share Aaron’s concern about the fact that this code means three things, two of them unrelated to the other, but unfortunately there doesn’t appear to be an IANA expansion point here to allow easy allocation of a new reason code. However a short RFC could allocate a “compliance (9)” reason code and describe its proper use, if desired.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I hope I don’t have to state that the CABForum unilaterally choosing to use an undocumented reason code would be highly undesirable.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>-Tim<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b>From:</b> Servercert-wg <<a href="mailto:servercert-wg-bounces@cabforum.org" target="_blank">servercert-wg-bounces@cabforum.org</a>> <b>On Behalf Of </b>Aaron Gable via Servercert-wg<br><b>Sent:</b> Wednesday, February 1, 2023 1:30 PM<br><b>To:</b> Ben Wilson <<a href="mailto:bwilson@mozilla.com" target="_blank">bwilson@mozilla.com</a>>; CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>><br><b>Subject:</b> Re: [Servercert-wg] Discussion Period Begins: Ballot SC-061v3: New CRL Entries must have a Revocation Reason Code<o:p></o:p></p></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I will admit that I also don't *love* using Superseded for this purpose. However:<o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>- There is no other revocation reason that is better: it's certainly not keyCompromise, affiliationChanged, cessationOfOperation, or privilegeWithdrawn. Using "unspecified" for such incidents also feels bad, as this lumps together CA-initiated revocations due to incidents with the majority of Subscriber-requested revocations.<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>- This ballot is attempting to incorporate current Mozilla requirements into the BRs. The MRSP currently says that Superseded should be used for this purpose. If the BRs choose to diverge from MRSP in this way, there will be contradictory requirements until one or the other changes.<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>- One could choose to interpret Superseded as, rather than a declaration that the CA already has replaced the certificate, a declaration that they're *willing* to. A no-fault revocation, for lack of a better term.<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>None of these are particularly strong arguments in favor of using Superseded for this purpose, but together I think they make it the most reasonable option.<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Aaron<o:p></o:p></p></div></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On Wed, Feb 1, 2023 at 10:01 AM Ben Wilson via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Thanks, Wendy.<o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Do others want to chime in on these points?<o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Ben<o:p></o:p></p></div></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On Wed, Feb 1, 2023, 10:45 AM Wendy Brown - QT3LB-C <<a href="mailto:wendy.brown@gsa.gov" target="_blank">wendy.brown@gsa.gov</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Superseded for these 2 reasons doesn't seem appropriate unless you also add that a new certificate was issued or at least requested, as a replacement.<o:p></o:p></p><blockquote style='margin-left:30.0pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>6. The Certificate no longer complies with the requirements of [Section 6.1.5](#615-key-sizes) and [Section 6.1.6](#616-public-key-parameters-generation-and-quality-checking) (CRLReason #4, superseded);<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>and<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>12. The CA is made aware that the Certificate was not issued in accordance with these Requirements or the CA's Certificate Policy or Certification Practice Statement (CRLReason #4, superseded);<o:p></o:p></p></div></blockquote><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>The definition isn't clear that a new cert has been issued (or even requested) based on the highlighted text - was it supposed to say that the CA issued a replacement certificate because it has reasonable evidence ....? Or should it just have ended with a . before the ", or the CA has ..."<o:p></o:p></p></div><div><blockquote style='margin-left:30.0pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> * **superseded (RFC 5280 CRLReason #4):** Indicates that the Certificate Subscriber has requested a new Certificate to replace an existing Certificate,<span style='color:black;background:yellow'> or the CA has reasonable evidence that the validation of domain authorization or control for any fully‐qualified domain name or IP address in the Certificate should not be relied upon or the CA has revoked the Certificate for compliance reasons such as the Certificate does not comply with these Baseline Requirements or the CA's CP or CPS;</span><br clear=all><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div></blockquote><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Thanks,<o:p></o:p></p><div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='font-family:"Segoe Script"'>Wendy</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Wendy Brown<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Supporting GSA<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>FPKIMA Technical Liaison<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Protiviti Government Services<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>703-965-2990 (cell)<o:p></o:p></p></div></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On Wed, Feb 1, 2023 at 12:22 PM Aaron Gable via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Wonderful, thank you! I have no further comments.<o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Aaron<o:p></o:p></p></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On Tue, Jan 31, 2023 at 4:08 PM Ben Wilson <<a href="mailto:bwilson@mozilla.com" target="_blank">bwilson@mozilla.com</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Thanks, Aaron - the numbering change was unintentional, so I fixed that, and I made other changes as requested. See <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><a href="https://avanan.url-protection.com/v1/url?o=https%3A//github.com/BenWilson-Mozilla/servercert/commit/f1ed2357c6c9fe9bcedaec040582f872e0f519de&g=YWViMDQzOWVjODgwNjI1Nw==&h=N2Q0ODVjYjQ2NGM1ZTM4NWM0MDQ5MTlmYmMyZWIzY2Q1YzM0YjhhMjBkNzdlOGMzNTE5YmMzMjlmZWM3MWFlNw==&p=YXAzOmRpZ2ljZXJ0OmE6bzpjODAzMjllZGMxNDZmMjFjOWU4MzU3NDA0ZDE4M2MwMzp2MTpoOkY=" target="_blank" title="Protected by Avanan: https://github.com/BenWilson-Mozilla/servercert/commit/f1ed2357c6c9fe9bcedaec040582f872e0f519de">https://github.com/BenWilson-Mozilla/servercert/commit/f1ed2357c6c9fe9bcedaec040582f872e0f519de </a><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Before I re-announce the discussion period, does anyone else have other changes that they would like to see?<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Thanks, <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Ben<o:p></o:p></p></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On Mon, Jan 30, 2023 at 9:58 AM Aaron Gable <<a href="mailto:aaron@letsencrypt.org" target="_blank">aaron@letsencrypt.org</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>The current redline appears to undo the recent renumbering of section 4.9.1.1, causing it to have two different instances of paragraphs 1 through 5. These were renumbered in Ballot SC-56 Cleanup[1]. Can we please preserve the new numbering?<o:p></o:p></p><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Additional notes:<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>- In 4.1.1.1 (1), perhaps "without specifying a CRLReason", rather than "without giving a reason"? A Subscriber might state "Please revoke this because I accidentally deleted the keys", in which case they are giving a reason, but the best revocation reason is still 0 (Unspecified). One might believe that Superseded is applicable in this case, but that revocation request does not necessarily indicate that the Subscriber has also replaced the certificate.<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>- A very minor comment, but there's inconsistent phrasing between the five revocation reasons in Section 7.2.2: the first begins "Indicates that..." while the others begin "It is intended to be used...". Can we give all five of these entries the same structure/phrasing?<o:p></o:p></p></div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Aaron<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>[1] <a href="https://avanan.url-protection.com/v1/url?o=https%3A//github.com/cabforum/servercert/pull/401/files%23diff-e0ac1bd190515a4f2ec09139d395ef6a8c7e9e5b612957c1f5a2dea80c6a6cfeR1214-R1224&g=M2UwYTBkMDgwN2Q5MTExYg==&h=MzhiZDYwZGUxNjhjYjlhZDgxOTkyNzVkMWRiZTUxODAzYmJkM2M4ZTc1MmZhMjkxYzBiZWJlYzE3YzQzY2NmYg==&p=YXAzOmRpZ2ljZXJ0OmE6bzpjODAzMjllZGMxNDZmMjFjOWU4MzU3NDA0ZDE4M2MwMzp2MTpoOkY=" target="_blank" title="Protected by Avanan: https://github.com/cabforum/servercert/pull/401/files#diff-e0ac1bd190515a4f2ec09139d395ef6a8c7e9e5b612957c1f5a2dea80c6a6cfeR1214-R1224">https://github.com/cabforum/servercert/pull/401/files#diff-e0ac1bd190515a4f2ec09139d395ef6a8c7e9e5b612957c1f5a2dea80c6a6cfeR1214-R1224</a><o:p></o:p></p></div></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>On Thu, Jan 19, 2023 at 1:55 PM Ben Wilson via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt'><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>All,<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>This is version 3 of Ballot SC-061. I've moved some of the language down into section 7.2.2, and I've added back in two paragraphs that have been in the original Mozilla Root Store Policy regarding changing the reason code and revocation date for key compromise. I also changed the compliance date to July 15, 2023. (The compliance date for CAs in Mozilla's program was Oct. 1, 2022.)<o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b>Purpose of Ballot SC-061 v.3</b><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>The purpose of this ballot is to modify sections 4.9.1.1 and 7.2.2 of the Baseline Requirements to incorporate the CRL reason codes that Mozilla has adopted in section 6.1.1 of the Mozilla Root Store Policy. <o:p></o:p></p></div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><b>Motion</b> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'>The following motion has been proposed by Ben Wilson of Mozilla and endorsed by David Kluge of Google Trust Services and Kiran Tummala of Microsoft.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'><b>—–Motion Begins—–</b><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'>This ballot modifies sections 4.9.1.1 and 7.2.2 of the “Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates” as defined in the following redline, based on Version 1.8.6:<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'><a href="https://avanan.url-protection.com/v1/url?o=https%3A//github.com/cabforum/servercert/compare/2c63814fa7f9f7c477c74a6bfbeb57e0fcc5dd5b..b1a3d9b491c9744a50a0e194678d76c639d6076b&g=ODQ0Mzc1NzQ3OGVhNjQyZg==&h=OGYwYjI0YmRmYjUwNzllMzU5MTkwOWQ4ZTZkYjEwMGVjN2IwNzg3ZDc5ZDA1ZDZkNjJlZjc0MzBkYjAzOTNlZA==&p=YXAzOmRpZ2ljZXJ0OmE6bzpjODAzMjllZGMxNDZmMjFjOWU4MzU3NDA0ZDE4M2MwMzp2MTpoOkY=" target="_blank" title="Protected by Avanan: https://github.com/cabforum/servercert/compare/2c63814fa7f9f7c477c74a6bfbeb57e0fcc5dd5b..b1a3d9b491c9744a50a0e194678d76c639d6076b">https://github.com/cabforum/servercert/compare/2c63814fa7f9f7c477c74a6bfbeb57e0fcc5dd5b..b1a3d9b491c9744a50a0e194678d76c639d6076b</a><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <b>—–Motion Ends—–</b><o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows: <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'>Discussion (7+ days)<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'>Start Time: January 19, 2023 22:00 UTC<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'>End Time: January 26, 2023 22:00 UTC<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'>Vote for approval (7 days)<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'>Start Time: January 26, 2023 TBD<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;margin-bottom:8.0pt;line-height:105%'>End Time: February 2, 2023 TBD<o:p></o:p></p></div></div></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>_______________________________________________<br>Servercert-wg mailing list<br><a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br><a href="https://avanan.url-protection.com/v1/url?o=https%3A//lists.cabforum.org/mailman/listinfo/servercert-wg&g=ZjM2YTU2YmIyNDQwOWVhMA==&h=YWJmMDk1Mjc0OWU1MTM1ZmVlYmY3YTU1MTc0MzdjMzkxYTk4Mjc4NTVmNzE2YWRlZGE1Yzc3MTRmMmU3MjhkNw==&p=YXAzOmRpZ2ljZXJ0OmE6bzpjODAzMjllZGMxNDZmMjFjOWU4MzU3NDA0ZDE4M2MwMzp2MTpoOkY=" target="_blank" title="Protected by Avanan: https://lists.cabforum.org/mailman/listinfo/servercert-wg">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><o:p></o:p></p></blockquote></div></blockquote></div></blockquote></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>_______________________________________________<br>Servercert-wg mailing list<br><a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br><a href="https://avanan.url-protection.com/v1/url?o=https%3A//lists.cabforum.org/mailman/listinfo/servercert-wg&g=NzhhMDFhZTQxMjk2YzRkNw==&h=NmFkMjZmNDIyNjhmZjg4MzI4ZjVlOTA4MzQ3ZGQ3NTIyYWUxZTliMTYyMDc4NmE2MzZjMTE4MTU1MjU5Mjg4NA==&p=YXAzOmRpZ2ljZXJ0OmE6bzpjODAzMjllZGMxNDZmMjFjOWU4MzU3NDA0ZDE4M2MwMzp2MTpoOkY=" target="_blank" title="Protected by Avanan: https://lists.cabforum.org/mailman/listinfo/servercert-wg">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><o:p></o:p></p></blockquote></div></blockquote></div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>_______________________________________________<br>Servercert-wg mailing list<br><a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br><a href="https://avanan.url-protection.com/v1/url?o=https%3A//lists.cabforum.org/mailman/listinfo/servercert-wg&g=M2IyNjQyM2EzN2Q3YmUxNg==&h=NzcwNzMxNGExYzMzN2Y2NDY1MDdjMGZjOGUxMDRkZGM5NmQwYTIzNTFmNWRiYzMzMjc4YTM3ZDE2NzE2NWYxMQ==&p=YXAzOmRpZ2ljZXJ0OmE6bzpjODAzMjllZGMxNDZmMjFjOWU4MzU3NDA0ZDE4M2MwMzp2MTpoOkY=" target="_blank" title="Protected by Avanan: https://lists.cabforum.org/mailman/listinfo/servercert-wg">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><o:p></o:p></p></blockquote></div></div></div></div></div></blockquote></div></div></body></html>