<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:536427608;
mso-list-template-ids:-1761199006;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1
{mso-list-id:1292664260;
mso-list-template-ids:441507462;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2
{mso-list-id:1437365653;
mso-list-template-ids:1185024034;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3
{mso-list-id:1660647741;
mso-list-template-ids:-166153698;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4
{mso-list-id:1872110253;
mso-list-template-ids:280149002;}
@list l4:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l4:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l4:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l5
{mso-list-id:2047825475;
mso-list-template-ids:822242114;}
@list l5:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l5:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l5:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l5:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l5:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l5:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l5:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l5:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Ryan,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Per the Short-lived Subscriber Certificate definition, many CAs may already issue certificates with a short validity period. I also think the definition is missing the intended use which is a certificate with no certificate status. How
about this definition?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">**Short-lived Subscriber Certificate**: Certificate issued with a short Validity Period, where the CA MAY NOT provide Subscriber Certificate status.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The validity period does not need to go in the definition as it is addressed in section 6.3.2.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks, Bruce.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Servercert-wg <servercert-wg-bounces@cabforum.org>
<b>On Behalf Of </b>Ryan Dickson via Servercert-wg<br>
<b>Sent:</b> Friday, May 12, 2023 10:45 AM<br>
<b>To:</b> ServerCert CA/BF <servercert-wg@cabforum.org><br>
<b>Subject:</b> [EXTERNAL] [Servercert-wg] Discussion Period Begins - Ballot SC-063 V2: “Make OCSP Optional, Require CRLs, and Incentivize Automation”<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">WARNING: This email originated outside of Entrust.<br>
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<div>
<p style="margin:0in"><b><span style="font-family:"Arial",sans-serif;color:black">Purpose of Ballot SC-063</span></b><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p style="margin:0in"><span style="font-family:"Arial",sans-serif;color:black">This Ballot proposes updates to the
<i>Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates</i> related to making Online Certificate Status Protocol (OCSP) services optional for CAs. This proposal does not prohibit or otherwise restrict CAs who choose to continue
supporting OCSP from doing so. If CAs continue supporting OCSP, the same requirements apply as they exist today.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:10.0pt;margin-left:0in">
<span style="font-family:"Arial",sans-serif;color:black">Additionally, this proposal introduces changes related to CRL requirements including:</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l1 level1 lfo1;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<span style="font-family:"Arial",sans-serif">CRLs must conform with the proposed profile.<o:p></o:p></span></li><li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l1 level1 lfo1;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<span style="font-family:"Arial",sans-serif">CAs must generate and publish either:<o:p></o:p></span></li></ul>
<ul style="margin-top:0in" type="disc">
<ul style="margin-top:0in" type="circle">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l1 level2 lfo1;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<span style="font-family:"Arial",sans-serif">a full and complete, or <o:p></o:p></span></li><li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l1 level2 lfo1;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<span style="font-family:"Arial",sans-serif">a set partitioned CRLs (sometimes called “sharded” CRLs), that when aggregated, represent the equivalent of a full and complete CRL.<o:p></o:p></span></li></ul>
</ul>
<ul style="margin-top:0in" type="disc">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l1 level1 lfo1;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<span style="font-family:"Arial",sans-serif">CAs issuing Subscriber Certificates must update and publish a new CRL…<o:p></o:p></span></li></ul>
<ul style="margin-top:0in" type="disc">
<ul style="margin-top:0in" type="circle">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l1 level2 lfo1;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<span style="font-family:"Arial",sans-serif">within twenty-four (24) hours after recording a Certificate as revoked; and <o:p></o:p></span></li><li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l1 level2 lfo1;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<span style="font-family:"Arial",sans-serif">Otherwise: <o:p></o:p></span></li></ul>
</ul>
<ul style="margin-top:0in" type="disc">
<ul style="margin-top:0in" type="circle">
<ul style="margin-top:0in" type="square">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l1 level3 lfo1;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<span style="font-family:"Arial",sans-serif">at least every seven (7) days if all Certificates include an Authority Information Access extension with an id-ad-ocsp accessMethod (“AIA OCSP pointer”), or<o:p></o:p></span></li><li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l1 level3 lfo1;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<span style="font-family:"Arial",sans-serif">at least every four (4) days in all other cases.<o:p></o:p></span></li></ul>
</ul>
</ul>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="margin:0in"><span style="font-family:"Arial",sans-serif;color:black">Finally, the proposal revisits the concept of a “short-lived” certificate, introduced in
</span><span style="font-family:"Arial",sans-serif"><a href="https://urldefense.com/v3/__https:/cabforum.org/2015/11/11/ballot-153-short-lived-certificates/__;!!FJ-Y8qCqXTj2!ec7WaYy6SmcqHXzp4ZUC07gxOu6FbC6Vv3mv5zUfK7RBVFAxnC-_yZF22eVUywU7Bh27z1QMTxACUx4jxgPzZJc1Xh8HuQ$"><span style="color:black">Ballot
153</span></a><span style="color:black">. As described in this ballot, short-lived certificates (sometimes called “short-term certificates” in ETSI
</span><a href="https://urldefense.com/v3/__https:/www.etsi.org/deliver/etsi_en/319400_319499/31941201/01.04.04_60/en_31941201v010404p.pdf__;!!FJ-Y8qCqXTj2!ec7WaYy6SmcqHXzp4ZUC07gxOu6FbC6Vv3mv5zUfK7RBVFAxnC-_yZF22eVUywU7Bh27z1QMTxACUx4jxgPzZJcV9nswVQ$"><span style="color:#4A6EE0">specifications</span></a><span style="color:black">)
are:</span><o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l5 level1 lfo2;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<b><span style="font-family:"Arial",sans-serif">optional</span></b><span style="font-family:"Arial",sans-serif">. CAs will not be required to issue short-lived certificates. For TLS certificates that do not meet the definition of a short-lived certificate introduced
in this proposed update, the current maximum validity period of 398 days remains applicable. <o:p></o:p></span></li></ul>
<ul style="margin-top:0in" type="disc">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l2 level1 lfo3;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<b><span style="font-family:"Arial",sans-serif">constrained to an initial maximum validity period of ten (10) days.</span></b><span style="font-family:"Arial",sans-serif"> The proposal stipulates that short-lived certificates issued on or after 15 March 2026
must not have a Validity Period greater than seven (7) days.<o:p></o:p></span></li></ul>
<ul style="margin-top:0in" type="disc">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l4 level1 lfo4;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal">
<b><span style="font-family:"Arial",sans-serif">not required to contain a CRLDP or OCSP pointer and are not required to be revoked</span></b><span style="font-family:"Arial",sans-serif">. The primary mechanism of certificate invalidation for these short-lived
certificates would be through certificate expiry. CAs may optionally revoke short-lived certificates. The initial maximum certificate validity is aligned with the existing maximum values for CRL “nextUpdate” and OCSP response validity allowed by the BRs today. <o:p></o:p></span></li></ul>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="margin:0in"><span style="font-family:"Arial",sans-serif;color:black">Additional background, justification, and considerations are outlined
</span><span style="font-family:"Arial",sans-serif"><a href="https://urldefense.com/v3/__https:/docs.google.com/document/d/180T6cDSWPy54Rb5d6R4zN7MuLEMShaZ4IRLQgdPqE98/edit__;!!FJ-Y8qCqXTj2!ec7WaYy6SmcqHXzp4ZUC07gxOu6FbC6Vv3mv5zUfK7RBVFAxnC-_yZF22eVUywU7Bh27z1QMTxACUx4jxgPzZJd5hnh1NA$"><span style="color:#4A6EE0">here</span></a><span style="color:black">.</span><o:p></o:p></span></p>
<p style="margin:0in"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="margin:0in"><span style="font-family:"Arial",sans-serif;color:black">The set of updates resulting from the
<a href="https://urldefense.com/v3/__https:/lists.cabforum.org/pipermail/servercert-wg/2023-April/003685.html__;!!FJ-Y8qCqXTj2!ec7WaYy6SmcqHXzp4ZUC07gxOu6FbC6Vv3mv5zUfK7RBVFAxnC-_yZF22eVUywU7Bh27z1QMTxACUx4jxgPzZJdnKNNEeA$">
first</a> round of discussion are presented <a href="https://urldefense.com/v3/__https:/github.com/ryancdickson/staging/pull/3/files__;!!FJ-Y8qCqXTj2!ec7WaYy6SmcqHXzp4ZUC07gxOu6FbC6Vv3mv5zUfK7RBVFAxnC-_yZF22eVUywU7Bh27z1QMTxACUx4jxgPzZJdDevajIg$">
here</a>.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="margin:0in"><span style="font-family:"Arial",sans-serif;color:black">The following motion has been proposed by Ryan Dickson and Chris Clements of Google (Chrome Root Program) and endorsed by Kiran Tummala of Microsoft and Tim Callan of Sectigo.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="margin:0in"><b><span style="font-family:"Arial",sans-serif;color:black">— Motion Begins —</span></b><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="margin:0in"><span style="font-family:"Arial",sans-serif;color:black">This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates” (“Baseline Requirements”), based on Version 2.0.0.</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="margin:0in"><span style="font-family:"Arial",sans-serif;color:black">MODIFY the Baseline Requirements as specified in the following Redline: </span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p style="margin:0in"><span style="font-family:"Arial",sans-serif"><a href="https://urldefense.com/v3/__https:/github.com/cabforum/servercert/compare/a0360b61e73476959220dc328e3b68d0224fa0b3..e2ac49ff90d1e74e9f08a398cd2df2d58e65b0ec__;!!FJ-Y8qCqXTj2!ec7WaYy6SmcqHXzp4ZUC07gxOu6FbC6Vv3mv5zUfK7RBVFAxnC-_yZF22eVUywU7Bh27z1QMTxACUx4jxgPzZJdGFo_MOA$">https://github.com/cabforum/servercert/compare/a0360b61e73476959220dc328e3b68d0224fa0b3..e2ac49ff90d1e74e9f08a398cd2df2d58e65b0ec</a><span style="color:#0E101A"> </span><o:p></o:p></span></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="margin:0in"><b><span style="font-family:"Arial",sans-serif;color:black">— Motion Ends —</span></b><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="margin:0in"><span style="font-family:"Arial",sans-serif;color:black">This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:</span><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="margin:0in"><b><span style="font-family:"Arial",sans-serif;color:black">Discussion (14+ days)</span></b><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:47.0pt;text-indent:-.25in;mso-list:l0 level1 lfo5;vertical-align:baseline">
<![if !supportLists]><span style="font-size:10.0pt;font-family:Symbol;color:black"><span style="mso-list:Ignore">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-family:"Arial",sans-serif;color:black">Start time: 2023-05-12 14:45:00 UTC<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:47.0pt;text-indent:-.25in;mso-list:l0 level1 lfo5;vertical-align:baseline">
<![if !supportLists]><span style="font-size:10.0pt;font-family:Symbol;color:black"><span style="mso-list:Ignore">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-family:"Arial",sans-serif;color:black">End time: Not before 2023-05-26 14:45:00 UTC<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p style="margin:0in"><b><span style="font-family:"Arial",sans-serif;color:black">Vote for approval (7 days)</span></b><span style="font-family:"Arial",sans-serif"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:47.0pt;text-indent:-.25in;mso-list:l3 level1 lfo6;vertical-align:baseline">
<![if !supportLists]><span style="font-size:10.0pt;font-family:Symbol;color:black"><span style="mso-list:Ignore">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-family:"Arial",sans-serif;color:black">Start time: TBD<o:p></o:p></span></p>
<p style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:47.0pt;text-indent:-.25in;mso-list:l3 level1 lfo6;vertical-align:baseline">
<![if !supportLists]><span style="font-size:10.0pt;font-family:Symbol;color:black"><span style="mso-list:Ignore">·<span style="font:7.0pt "Times New Roman"">
</span></span></span><![endif]><span style="font-family:"Arial",sans-serif;color:black">End time: TBD<o:p></o:p></span></p>
</div>
</div>
<i>Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the
information it contains. <u>Please notify Entrust immediately</u> and delete the message from your system.</i>
</body>
</html>