<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
p.paragraph, li.paragraph, div.paragraph
{mso-style-name:paragraph;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.normaltextrun
{mso-style-name:normaltextrun;}
span.eop
{mso-style-name:eop;}
span.scxw53035567
{mso-style-name:scxw53035567;}
span.EmailStyle22
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:280454162;
mso-list-type:hybrid;
mso-list-template-ids:-1186420434 67698689 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l1
{mso-list-id:1024669387;
mso-list-template-ids:-1749095524;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>While the ballot does not specifically address the concerns about the value of Debian checks, etc., I felt that the removal of the review should be better considered in a future ballot initiative. SSL.com believes that an overabundance of caution is beneficial to the community, even if it is a drain on resources. We hope that the ballot, as presented, does not represent an overwhelming burden on CAs. <o:p></o:p></p><p class=MsoNormal><br>We do agree with the sentiment that most weak-key submissions have been by security researchers, but the occasional customer who is spared the potentially devastating effects of using a weak certificate makes the efforts worthwhile. We would consider, and possibly agree, to the removal of Debian weak-key checks and the revocation requirements of 4.9.1.1 (4), but we would also likely continue to perform the assessments for the benefits of our customers and relying parties. However, as stated, we feel that this avenue of discussion is better traveled after the strengthening of current BR requirements for the prevention of modern threats. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Tom<o:p></o:p></p><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='mso-ligatures:none'>From:</span></b><span style='mso-ligatures:none'> Servercert-wg <servercert-wg-bounces@cabforum.org> <b>On Behalf Of </b>Tom Zermeno via Servercert-wg<br><b>Sent:</b> Monday, June 26, 2023 4:35 PM<br><b>To:</b> Infrastructure Bot via Servercert-wg <servercert-wg@cabforum.org><br><b>Subject:</b> [Servercert-wg] SC-59 Weak Key Guidance v.2 - Discussion Period<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=paragraph style='vertical-align:baseline'><span class=normaltextrun><span style='font-size:12.0pt'>My apologies to the community for not properly submitting the updated version (v2) of the SC-59 Weak Key Guidance ballot for discussion. Please disregard the previous call to vote and allow a 7-day period to discuss the changes made to the ballot. <o:p></o:p></span></span></p><p class=paragraph style='vertical-align:baseline'><span class=normaltextrun><span style='font-size:12.0pt'>Notes:<o:p></o:p></span></span></p><ul type=disc><li class=paragraph style='mso-list:l0 level1 lfo3;vertical-align:baseline'><span class=normaltextrun>Thank you to the participants who voiced opinions and concerns about the previous version of the ballot. While there were many concerns about the inclusion of the Debian weak keys checks, we have decided to leave the checks in the ballot. Our reasoning is that we wanted to strengthen the guidance statements, to help CAs ensure compliant certificate generation. Future reviews of the BRs may cull the requirements, as is required by the needs of the community. <o:p></o:p></span></li><li class=paragraph style='mso-list:l0 level1 lfo3;vertical-align:baseline'><span class=normaltextrun>We believe that the requested date of November 15, 2023, will allow enough time for Certificate Authorities to enact any changes to their systems to ensure that they perform the weak key checks on all CSRs submitted for TLS certificates. <o:p></o:p></span></li><li class=paragraph style='mso-list:l0 level1 lfo3;vertical-align:baseline'><span class=normaltextrun><span style='font-size:12.0pt;color:black'>The changes introduced in SC-59 do not conflict with any of the recent ballots. As observed with other ballots in the past, minor administrative updates must be made to the proposed ballot text before publication such that the appropriate Version # and Change History are accurately represented (e.g., to indicate these changes will be represented in Version 2.0.1). </span></span><span class=eop><span style='font-size:12.0pt;color:black'> </span></span><o:p></o:p></li></ul><p class=paragraph style='vertical-align:baseline'><span class=eop><span style='font-size:12.0pt'>The following motion has been proposed by Thomas Zermeno of SSL.com and has been endorsed by Martijn Katerbarg of Sectigo and Ben Wilson of Mozilla. </span></span><span style='font-size:12.0pt'><o:p></o:p></span></p><p class=paragraph style='vertical-align:baseline'><span class=normaltextrun><b>- Motion Begins -</b> </span><span class=eop> </span><o:p></o:p></p><p class=paragraph style='vertical-align:baseline'><span class=normaltextrun><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:#0E101A'>This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates” (“Baseline Requirements”), based on Version 2.0.0.</span></span><span class=eop><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:#0E101A'> </span></span><o:p></o:p></p><p class=paragraph style='vertical-align:baseline'><span class=normaltextrun><span style='font-size:10.5pt;font-family:"Arial",sans-serif;color:#0E101A'>MODIFY the Baseline Requirements as specified in the following Redline: </span></span><a href="https://github.com/cabforum/servercert/compare/a0360b61e73476959220dc328e3b68d0224fa0b3...SSLcom:servercert:958e6ccac857b826fead6e4bd06d58f4fdd7fa7a" target="_blank"><span class=normaltextrun>https://github.com/cabforum/servercert/compare/a0360b61e73476959220dc328e3b68d0224fa0b3...SSLcom:servercert:958e6ccac857b826fead6e4bd06d58f4fdd7fa7a</span></a><span class=normaltextrun> </span><span class=eop> </span><o:p></o:p></p><p><span class=normaltextrun><b>- Motion Ends<span style='color:#0078D4'> -</span></b></span><span class=eop> </span><span style='font-size:12.0pt'><br><br><span style='color:#0E101A'>The procedure for approval of this ballot is as follows:</span><span style='color:black'><o:p></o:p></span></span></p><p class=paragraph style='vertical-align:baseline'><span class=normaltextrun><span style='font-size:12.0pt'>Discussion (7 days) </span><o:p></o:p></span></p><p class=paragraph style='vertical-align:baseline'><span class=normaltextrun><span style='font-size:12.0pt'>• Start time: 2023-06-26 22:00:00 UTC <o:p></o:p></span></span></p><p class=paragraph style='vertical-align:baseline'><span class=normaltextrun><span style='font-size:12.0pt'>• End time: 2023-07-03 21:59:59 UTC</span></span><span class=scxw53035567><span style='font-size:12.0pt'> </span></span><o:p></o:p></p><p class=paragraph style='vertical-align:baseline'><span class=normaltextrun><span style='font-size:12.0pt'>Vote for approval (7 days)</span></span><span class=eop><span style='font-size:12.0pt'> </span></span><span style='font-size:12.0pt'><o:p></o:p></span></p><p class=paragraph style='vertical-align:baseline'><span class=normaltextrun><span style='font-size:12.0pt'> • Start Time: TBD</span></span><span style='font-size:12.0pt'><o:p></o:p></span></p><p class=paragraph style='vertical-align:baseline'><span class=normaltextrun><span style='font-size:12.0pt'> • End Time: TBD</span></span><span class=eop><span style='font-size:12.0pt'> </span></span><span style='font-size:12.0pt'><o:p></o:p></span></p><p class=MsoNormal><span style='font-size:12.0pt'><o:p> </o:p></span></p></div></body></html>