<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML con formato previo Car";
margin:0cm;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLconformatoprevioCar
{mso-style-name:"HTML con formato previo Car";
mso-style-priority:99;
mso-style-link:"HTML con formato previo";
font-family:Consolas;}
span.EstiloCorreo21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 3.0cm 70.85pt 3.0cm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="ES" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">Yes, in the already published version 2.0.2, the section 7.1.5 is included. This section is empty as many other sections in the TLS BRs, for example, 7.1.7, 7.1.8 and 7.1.9, which are
just right after.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US">></span><span lang="EN-GB"> Hopefully we can add pointers to the right name constraints language<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB">Sure.</span><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-GB" style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>De:</b> Servercert-wg <servercert-wg-bounces@cabforum.org>
<b>En nombre de </b>Dimitris Zacharopoulos (HARICA) via Servercert-wg<br>
<b>Enviado el:</b> jueves, 4 de enero de 2024 17:56<br>
<b>Para:</b> Ben Wilson <bwilson@mozilla.com>; CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org><br>
<b>Asunto:</b> Re: [Servercert-wg] Section 7.1.5 as required by RFC 3647 is no longer in the TLS BRs<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:solid black 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt">
<p class="MsoNormal" style="line-height:12.0pt;background:#FAFA03"><span style="font-size:10.0pt;color:black">CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the
content is safe.<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 4/1/2024 5:50 μ.μ., Ben Wilson wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">I think this is listed as an issue in GitHub - <a href="https://github.com/cabforum/servercert/issues/444">
https://github.com/cabforum/servercert/issues/444</a>.<o:p></o:p></p>
</div>
</blockquote>
<p class="MsoNormal"><br>
Indeed, the cleanup ballot brings back the number 7.1.5 but the section is empty, despite the real information being already included in other sections of the BRs.<br>
<br>
Hopefully we can add pointers to the right name constraints language. Does that make sense?<br>
<br>
<br>
Dimitris.<br>
<br>
<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Thu, Jan 4, 2024 at 4:54 AM Dimitris Zacharopoulos (HARICA) via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal">Dear Members,<br>
<br>
While taking another pass at reviewing the new certificate profiles introduced in ballot SC62, I realized that there is some deviation from the RFC 3647 structure that the BRs should maintain to help alignment of CA CP/CPS documents.<br>
<br>
This is the structure defined by RFC 3647 for section 7:<o:p></o:p></p>
<pre> 7. CERTIFICATE, CRL, AND OCSP PROFILES<o:p></o:p></pre>
<pre> 7.1 Certificate profile<o:p></o:p></pre>
<pre> 7.1.1 Version number(s)<o:p></o:p></pre>
<pre> 7.1.2 Certificate extensions<o:p></o:p></pre>
<pre> 7.1.3 Algorithm object identifiers<o:p></o:p></pre>
<pre> 7.1.4 Name forms<o:p></o:p></pre>
<pre> 7.1.5 Name constraints<o:p></o:p></pre>
<pre> 7.1.6 Certificate policy object identifier<o:p></o:p></pre>
<pre> 7.1.7 Usage of Policy Constraints extension<o:p></o:p></pre>
<pre> 7.1.8 Policy qualifiers syntax and semantics<o:p></o:p></pre>
<pre> 7.1.9 Processing semantics for the critical Certificate Policies<o:p></o:p></pre>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
Section 7.1.5 does not exist anymore. The BRs have the name constraints information in 7.1.2.5.2, 7.1.2.10.8. I believe that, at a minimum, we should re-introduce 7.1.5 and point to other subsections of 7.1.2 for consistency with RFC 3647.<br>
<br>
Thoughts?<br>
Dimitris.<o:p></o:p></p>
</div>
<p class="MsoNormal">_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org">Servercert-wg@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><o:p></o:p></p>
</blockquote>
</div>
</blockquote>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>