<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Bruce,<div><br></div><div>I agree that this change will likely happen mostly naturally over time, which is really exactly what prompted the submission of the GitHub issue. In my view, it’s a desirable outcome to have extant subCAs which don’t comply with the v2 profiles be phased out (at some point), and it’s something that will happen to some extent regardless, so we should formalize a consensus-based date to ensure that happens completely (rather than risk some long tail of non-compliant CAs with no direction).</div><div><br></div><div>Cheers,</div><div>-Clint<br><div><br><blockquote type="cite"><div>On Jun 13, 2023, at 5:59 AM, Bruce Morton <bruce.morton@entrust.com> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Hi Clint,<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I am wondering with the move to dedicated PKI hierarchies, the Mozilla plan to retire roots, the Google moving forward direction, the end of 2048-bit RSA, if moving to new CA certificate profiles will just happen naturally over the next few years?<span class="Apple-converted-space"> </span><o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">My assumption is that all roots being submitted for root embedding should meet the requirement and so should the subordinate CAs. We have been using the draft certificate profile ballot for over a year before it was passed, to ensure our new certificate profiles would match what would be accepted in the future. Also note that the TLS BR certificate profile requirements are easily extended to other certificate type profiles, which may also be occurring.<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Thanks, Bruce.<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor; border-image: none; padding: 3pt 0in 0in;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><b>From:</b><span class="Apple-converted-space"> </span>Clint Wilson <<a href="mailto:notifications@github.com" style="color: blue; text-decoration: underline;">notifications@github.com</a>><span class="Apple-converted-space"> </span><br><b>Sent:</b><span class="Apple-converted-space"> </span>Monday, June 12, 2023 5:02 PM<br><b>To:</b><span class="Apple-converted-space"> </span>cabforum/servercert <<a href="mailto:servercert@noreply.github.com" style="color: blue; text-decoration: underline;">servercert@noreply.github.com</a>><br><b>Cc:</b><span class="Apple-converted-space"> </span>Subscribed <<a href="mailto:subscribed@noreply.github.com" style="color: blue; text-decoration: underline;">subscribed@noreply.github.com</a>><br><b>Subject:</b><span class="Apple-converted-space"> </span>[EXTERNAL] [cabforum/servercert] Explore & add transition period for CAs not compliant with profiles from SC-062 (Issue #436)<o:p></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">WARNING: This email originated outside of Entrust.<br>DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.<o:p></o:p></div><div class="MsoNormal" align="center" style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; text-align: center;"><hr size="2" width="100%" align="center"></div><p>With the update to v2.0 of the BRs, we have a great number of improved certificate profiles which are only enforced for new certificates issued. Given the improvements represented, it would be beneficial to ensure we have a target end date for ongoing usage of non-compliant (with the new profiles) CA certificates.<o:p></o:p></p><p><span style="font-size: 12pt; color: rgb(102, 102, 102);">—<br>Reply to this email directly,<span class="Apple-converted-space"> </span><a href="https://urldefense.com/v3/__https:/github.com/cabforum/servercert/issues/436__;!!FJ-Y8qCqXTj2!acqrEVvAEAAdn8wbYx9RVNctIdzvrE3vWLNORiItiG_YgX50b8yGW5azEmuxht0BgGrWKqKJ0IeLI63bTxUhgm9aqS8$" style="color: blue; text-decoration: underline;">view it on GitHub</a>, or<span class="Apple-converted-space"> </span><a href="https://urldefense.com/v3/__https:/github.com/notifications/unsubscribe-auth/ADFTP5YU3HIXZHAW4VERHS3XK57U3ANCNFSM6AAAAAAZD5LX74__;!!FJ-Y8qCqXTj2!acqrEVvAEAAdn8wbYx9RVNctIdzvrE3vWLNORiItiG_YgX50b8yGW5azEmuxht0BgGrWKqKJ0IeLI63bTxUhcHmTxS8$" style="color: blue; text-decoration: underline;">unsubscribe</a>.<br>You are receiving this because you are subscribed to this thread.</span><span style="font-size: 12pt; color: rgb(102, 102, 102);"><img border="0" width="1" height="1" id="_x0000_i1026" src="https://github.com/notifications/beacon/ADFTP57FAGNJIL6LICEY523XK57U3A5CNFSM6AAAAAAZD5LX76WGG33NNVSW45C7OR4XAZNFJFZXG5LFVJRW63LNMVXHIX3JMTHGRBMFII.gif" style="width: 0.0083in; height: 0.0083in;"></span><span style="font-size: 1pt; color: rgb(102, 102, 102);">Message ID: <<a href="mailto:cabforum/servercert/issues/436@github.com" style="color: blue; text-decoration: underline;">cabforum/servercert/issues/436@github.com</a>></span><span style="font-size: 12pt; color: rgb(102, 102, 102);"><o:p></o:p></span></p></div><i style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;">Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains.<span class="Apple-converted-space"> </span><u>Please notify Entrust immediately</u><span class="Apple-converted-space"> </span>and delete the message from your system.</i></div></blockquote></div><br></div></body></html>