<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Clint,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I am wondering with the move to dedicated PKI hierarchies, the Mozilla plan to retire roots, the Google moving forward direction, the end of 2048-bit RSA, if moving to new CA certificate profiles will just happen naturally over the next
few years? <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My assumption is that all roots being submitted for root embedding should meet the requirement and so should the subordinate CAs. We have been using the draft certificate profile ballot for over a year before it was passed, to ensure our
new certificate profiles would match what would be accepted in the future. Also note that the TLS BR certificate profile requirements are easily extended to other certificate type profiles, which may also be occurring.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks, Bruce.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Clint Wilson <notifications@github.com> <br>
<b>Sent:</b> Monday, June 12, 2023 5:02 PM<br>
<b>To:</b> cabforum/servercert <servercert@noreply.github.com><br>
<b>Cc:</b> Subscribed <subscribed@noreply.github.com><br>
<b>Subject:</b> [EXTERNAL] [cabforum/servercert] Explore & add transition period for CAs not compliant with profiles from SC-062 (Issue #436)<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">WARNING: This email originated outside of Entrust.<br>
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p>With the update to v2.0 of the BRs, we have a great number of improved certificate profiles which are only enforced for new certificates issued. Given the improvements represented, it would be beneficial to ensure we have a target end date for ongoing usage
of non-compliant (with the new profiles) CA certificates.<o:p></o:p></p>
<p style="-webkit-text-size-adjust:none"><span style="font-size:12.0pt;color:#666666">—<br>
Reply to this email directly, <a href="https://urldefense.com/v3/__https:/github.com/cabforum/servercert/issues/436__;!!FJ-Y8qCqXTj2!acqrEVvAEAAdn8wbYx9RVNctIdzvrE3vWLNORiItiG_YgX50b8yGW5azEmuxht0BgGrWKqKJ0IeLI63bTxUhgm9aqS8$">
view it on GitHub</a>, or <a href="https://urldefense.com/v3/__https:/github.com/notifications/unsubscribe-auth/ADFTP5YU3HIXZHAW4VERHS3XK57U3ANCNFSM6AAAAAAZD5LX74__;!!FJ-Y8qCqXTj2!acqrEVvAEAAdn8wbYx9RVNctIdzvrE3vWLNORiItiG_YgX50b8yGW5azEmuxht0BgGrWKqKJ0IeLI63bTxUhcHmTxS8$">
unsubscribe</a>.<br>
You are receiving this because you are subscribed to this thread.</span><span style="font-size:12.0pt;color:#666666"><img border="0" width="1" height="1" style="width:.0083in;height:.0083in" id="_x0000_i1026" src="https://github.com/notifications/beacon/ADFTP57FAGNJIL6LICEY523XK57U3A5CNFSM6AAAAAAZD5LX76WGG33NNVSW45C7OR4XAZNFJFZXG5LFVJRW63LNMVXHIX3JMTHGRBMFII.gif"></span><span style="font-size:1.0pt;color:#666666">Message
ID: <<a href="mailto:cabforum/servercert/issues/436@github.com">cabforum/servercert/issues/436@github.com</a>></span><span style="font-size:12.0pt;color:#666666"><o:p></o:p></span></p>
</div>
<i>Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the
information it contains. <u>Please notify Entrust immediately</u> and delete the message from your system.</i>
</body>
</html>