<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:0 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
p.null, li.null, div.null
{mso-style-name:null;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle25
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:376709278;
mso-list-template-ids:644395298;}
@list l1
{mso-list-id:481191825;
mso-list-template-ids:-284013076;}
@list l2
{mso-list-id:505756176;
mso-list-template-ids:-2110633462;}
@list l2:level1
{mso-level-start-at:3;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l3
{mso-list-id:529875841;
mso-list-template-ids:-902818912;}
@list l4
{mso-list-id:666791887;
mso-list-template-ids:1647246532;}
@list l5
{mso-list-id:762148833;
mso-list-template-ids:-1489845164;}
@list l6
{mso-list-id:1344943193;
mso-list-template-ids:-746260830;}
@list l6:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7
{mso-list-id:1556429635;
mso-list-template-ids:1597438270;}
@list l7:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l8
{mso-list-id:1649241478;
mso-list-template-ids:-499093192;}
@list l8:level1
{mso-level-start-at:2;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l9
{mso-list-id:1762674544;
mso-list-template-ids:-1209387266;}
@list l9:level1
{mso-level-start-at:2;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
@list l9:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l10
{mso-list-id:1823571447;
mso-list-template-ids:1840516694;}
@list l10:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l11
{mso-list-id:2115129949;
mso-list-template-ids:-567627166;}
@list l11:level1
{mso-level-start-at:2;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style></head><body lang=en-SE link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'>So, to capture some of this. The reason we’ve started address this line itself (route and firewall activities) is because it’s been interpreted by some as “anything the device does”, such as routing a single package. That’s the main item I’m trying to clarify within this ballot.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'>Taking another deeper dive in this, Section 5.4.1 starts with “SHALL record events related to the security of their Certificate Systems, Certificate Management Systems, Root CA Systems, and Delegated Third Party Systems.” – The fact that there’s a separate line for router and firewall activities, suggests that those may not fall under the definition of Certificate System, Certificate Management System or Root CA System. Looking at the definitions, I’d say router and firewalls fall under the Certificate Systems definition, since they are used in “…providing…validity status…”.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'>If we then go back to the “what must a CA log” question, there’s already a line showing “Successful and unsuccessful PKI system access attempts;”. Does the fact that this say “PKI system”, suddenly remove routers and firewalls from the scope of that item?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'>Almost similar, though not stating PKI systems, there already is a line for Security Profile Changes, which might as well incorporate firewall rule changes and configuration changes, and Christopher also pointed our correctly. System crashes, hardware failures and other anomalies is already covered. By other bullet points as well. <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'><br>With that in mind, is there even really any reason at all, for keeping “router and firewall activities” in there?<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'>I’ll answer the question from my point of view: I’d say yes, because it clarifies further that routers and firewall are in scope, and here’s what the CA needs to log for them. I don’t see a harm of providing that extra clarity in the BRs.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt;mso-fareast-language:EN-US'>Thoughts?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;mso-fareast-language:EN-US'><o:p> </o:p></span></p><div id=mail-editor-reference-message-container><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='margin-bottom:12.0pt'><b><span lang=EN-US style='font-size:12.0pt;font-family:"Aptos",sans-serif;color:black'>From: </span></b><span lang=EN-US style='font-size:12.0pt;font-family:"Aptos",sans-serif;color:black'>Servercert-wg <servercert-wg-bounces@cabforum.org> on behalf of Ponds-White, Trev via Servercert-wg <servercert-wg@cabforum.org><br><b>Date: </b>Tuesday, 6 February 2024 at 22:50<br><b>To: </b>Tim Hollebeek <tim.hollebeek@digicert.com>, CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org>, Christophe Bonjean <christophe.bonjean@globalsign.com><br><b>Subject: </b>Re: [Servercert-wg] [Discussion Period Begins]: SC-69 Clarify router and firewall logging requirements<o:p></o:p></span></p></div><div style='border:solid black 1.0pt;padding:2.0pt 2.0pt 2.0pt 2.0pt'><p class=MsoNormal style='line-height:12.0pt;background:#FAFA03'><span lang=EN-US style='color:black'>CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.<o:p></o:p></span></p></div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><div><div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Do we think that is already sufficiently taken care of by #5 (System crashes, hardware failures, and other anomalies;) on the security events list then? Or does it need to be specifically repeated for this item?</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>From:</span></b><span lang=EN-US style='font-size:11.0pt'> Tim Hollebeek <tim.hollebeek@digicert.com> <br><b>Sent:</b> Tuesday, February 6, 2024 10:08 AM<br><b>To:</b> Ponds-White, Trev <trevolip@amazon.com>; CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org>; Christophe Bonjean <christophe.bonjean@globalsign.com><br><b>Subject:</b> RE: [EXTERNAL] [Servercert-wg] [Discussion Period Begins]: SC-69 Clarify router and firewall logging requirements</span><span lang=EN-US><o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>There are a number of attack scenarios that cause network devices to crash/restart either as part of the attack, or as a consequence of the fallout from an attack. So paying attention to if some of your network hardware and software crashes unexpectedly and/or becomes significantly less stable can be a useful signal.</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>That’s at least the historical reason for including this sort of monitoring, I’ll ask Bindi if it still makes sense to be watching for that sort of stuff today.</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>-Tim</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0cm 0cm 0cm 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>From:</span></b><span lang=EN-US style='font-size:11.0pt'> Servercert-wg <<a href="mailto:servercert-wg-bounces@cabforum.org">servercert-wg-bounces@cabforum.org</a>> <b>On Behalf Of </b>Ponds-White, Trev via Servercert-wg<br><b>Sent:</b> Tuesday, February 6, 2024 12:59 PM<br><b>To:</b> Christophe Bonjean <<a href="mailto:christophe.bonjean@globalsign.com">christophe.bonjean@globalsign.com</a>>; CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>><br><b>Subject:</b> Re: [Servercert-wg] [Discussion Period Begins]: SC-69 Clarify router and firewall logging requirements</span><span lang=EN-US><o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>I had the same thought about firewall rules vs configuration changes being duplicative. I also agree about the dubious value of “</span><span lang=EN-US style='font-family:"Arial",sans-serif'>hardware failures, software crashes, and system restarts</span><span lang=EN-US style='font-size:11.0pt'>”. I left it in since it was there but I was kind of struggling to figure out the purpose of some of that information. I assume its there for the purpose of understanding the impact and duration of an unexpected outage of your boundary protections? I don’t think that list really gets you that but it might be a piece of the picture for some, but not all, environments. </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>From:</span></b><span lang=EN-US style='font-size:11.0pt'> Christophe Bonjean <<a href="mailto:christophe.bonjean@globalsign.com">christophe.bonjean@globalsign.com</a>> <br><b>Sent:</b> Tuesday, February 6, 2024 5:39 AM<br><b>To:</b> Ponds-White, Trev <<a href="mailto:trevolip@amazon.com">trevolip@amazon.com</a>>; CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>><br><b>Subject:</b> RE: [EXTERNAL] [Servercert-wg] [Discussion Period Begins]: SC-69 Clarify router and firewall logging requirements</span><span lang=EN-US><o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial",sans-serif'>I agree with Trev’s perspective.</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial",sans-serif'> </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-family:"Arial",sans-serif'>A few comments:</span><span lang=EN-US><o:p></o:p></span></p><ul style='margin-top:0cm' type=disc><li class=MsoListParagraph style='margin-left:0cm;mso-list:l6 level1 lfo1'><span lang=EN-US style='font-family:"Arial",sans-serif'>Firewall rules are a separate item, but aren’t firewall rules covered by configuration changes? Should we merge it?</span><span lang=EN-US><o:p></o:p></span></li><li class=MsoListParagraph style='margin-left:0cm;mso-list:l6 level1 lfo1'><span lang=EN-US style='font-family:"Arial",sans-serif'>What’s the purpose of “hardware failures, software crashes, and system restarts”? System restarts I could see how it’s relevant for audit logging purposes, but not sure what the additional value is of logging hardware failures and software crashes.</span><span lang=EN-US><o:p></o:p></span></li></ul><p class=MsoNormal><span lang=EN-US style='font-family:"Arial",sans-serif'> </span><span lang=EN-US><o:p></o:p></span></p><div><p class=MsoNormal><span lang=EN-US style='font-family:"Arial",sans-serif'>Christophe</span><span lang=EN-US><o:p></o:p></span></p></div><p class=MsoNormal><span lang=EN-US style='font-family:"Arial",sans-serif'> </span><span lang=EN-US><o:p></o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>From:</span></b><span lang=EN-US style='font-size:11.0pt'> Servercert-wg <<a href="mailto:servercert-wg-bounces@cabforum.org">servercert-wg-bounces@cabforum.org</a>> <b>On Behalf Of </b>Ponds-White, Trev via Servercert-wg<br><b>Sent:</b> Tuesday, February 6, 2024 3:08 AM<br><b>To:</b> Martijn Katerbarg <<a href="mailto:martijn.katerbarg@sectigo.com">martijn.katerbarg@sectigo.com</a>>; CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>>; Clint Wilson <<a href="mailto:clintw@apple.com">clintw@apple.com</a>><br><b>Subject:</b> Re: [Servercert-wg] [Discussion Period Begins]: SC-69 Clarify router and firewall logging requirements</span><span lang=EN-US><o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>I think “router and firewall activities” are solutions that don’t identify the problem we are trying to solve. Ultimately we want to know that the CA systems are segregated and protected. In this section we are specifying the required logs the CAs should have that allow them to monitor this and investigate if issues occur. I think it would be better to change this something like</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>“</span><span lang=EN-US>Network boundary controls (firewall, switch, router, gateway, or other network control device or system) activities. Relevant activities to log include configuration changes, firmware updates, and access control modifications. As well as system events and errors, including hardware failures, software crashes, and system restarts.”<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US>This also better aligns with NetSec 1.f “Configure each network boundary control (firewall, switch, router, gateway, or other network control device or system) with rules that support only the services, protocols, ports, and communications that the CA has identified as necessary to its operations;”<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>From:</span></b><span lang=EN-US style='font-size:11.0pt'> Servercert-wg <<a href="mailto:servercert-wg-bounces@cabforum.org">servercert-wg-bounces@cabforum.org</a>> <b>On Behalf Of </b>Martijn Katerbarg via Servercert-wg<br><b>Sent:</b> Monday, February 5, 2024 12:52 PM<br><b>To:</b> Clint Wilson <<a href="mailto:clintw@apple.com">clintw@apple.com</a>>; ServerCert CA/BF <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>><br><b>Subject:</b> RE: [EXTERNAL] [Servercert-wg] [Discussion Period Begins]: SC-69 Clarify router and firewall logging requirements</span><span lang=EN-US><o:p></o:p></span></p></div></div><p class=MsoNormal><span lang=EN-US> <o:p></o:p></span></p><table class=MsoNormalTable border=0 cellspacing=0 cellpadding=0 style='border-collapse:collapse'><tr style='height:15.25pt'><td width=1123 valign=top style='width:842.35pt;border:solid #ED7D31 1.5pt;padding:0cm 5.4pt 0cm 5.4pt;height:15.25pt'><p><strong><span style='font-family:"Calibri",sans-serif;color:black;background:#FFFF99'>CAUTION</span></strong><span style='color:black;background:#FFFF99'>: This email originated from outside of the organization. Do not click links or open attachments unless you can confirm the sender and know the content is safe.</span><o:p></o:p></p></td></tr></table><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Hi Clint,<br><br>Thanks for the feedback!</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><ol style='margin-top:0cm' start=1 type=1><li class=MsoNormal style='mso-list:l5 level1 lfo2'><span lang=EN-US style='font-size:11.0pt'>I’m not sure the wording "Router and firewall activities" is considered an unspecified term, and leaves the exact definition and scope up to the CA, however” is necessary or even really helpful. I think it would be clearer to introduce Section 5.4.1.1 with something like “Logging of router and firewall activities necessary to meet the requirements of Section 5.4.1, Subsection 3.6 MUST at a minimum include:”</span><span lang=EN-US><o:p></o:p></span></li></ol><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>I’d agree, this makes sense to update.</span><span lang=EN-US><o:p></o:p></span></p><ol style='margin-top:0cm' start=1 type=1><ul style='margin-top:0cm' type=circle><li class=MsoNormal style='mso-list:l7 level2 lfo3'><span lang=EN-US style='font-size:11.0pt'>I’m not sold on the “Subsection” part, but I don’t recall if we have good semantics established for referencing the numbered paragraphs/sections under a Section heading.</span><span lang=EN-US><o:p></o:p></span></li></ul></ol><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>This was more a design decision, since Section 5.4.1 is already a lengthy section with a lot of information. Personally I feel creating the subsection make it easier to follow through. I’m open to changing if more people feel this should be addressed.</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><ol style='margin-top:0cm' start=1 type=1><li class=MsoListParagraph style='margin-left:0cm;mso-list:l1 level1 lfo4'><span lang=EN-US style='font-size:11.0pt'>I think the entire section including and under "Logging of router and firewall activities SHOULD NOT include:” should be removed. </span><span lang=EN-US><o:p></o:p></span></li></ol><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Based on the reasoning provided, I agree that it doesn’t really add anything extra to the requirements.</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><ol style='margin-top:0cm' start=2 type=1><li class=MsoListParagraph style='margin-left:0cm;mso-list:l11 level1 lfo5'><span lang=EN-US style='font-size:11.0pt'>The concluding sentence "CAs are encouraged to recommend additional MUST and SHOULD NOT requirements through an email to <a href="mailto:questions@cabforum.org">questions@cabforum.org</a>, for future discussion within the appropriate Working Group.” stands out as I think it’s the only such “encouragement” in the BRs. I don’t think that makes it bad or that it should be removed, but I’m also not sure how valuable it is to the BRs as a policy. I admit that may be because I view this encouragement as fundamental to membership and participation in the CA/B Forum at all — every member, regardless of type, should feel welcome and encouraged to recommend changes to any of the CA/B Forum documents. But we don’t say that anywhere, so maybe this is a good start?</span><span lang=EN-US><o:p></o:p></span></li></ol><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>I took this approach from the CSWG, which used it during the switch to hardware-based keys. I’m not sure it was ever utilized however. </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>If there’s strong opinions on removing this, I don’t have a problem with that.</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><br>I’ll leave the comments open for a bit, before I make the above changes, in case there is more feedback.</span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><br>Regards,<br><br>Martijn </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal style='margin-bottom:12.0pt'><b><span lang=EN-US style='font-size:12.0pt;font-family:"Aptos",sans-serif;color:black'>From: </span></b><span lang=EN-US style='font-size:12.0pt;font-family:"Aptos",sans-serif;color:black'>Clint Wilson <<a href="mailto:clintw@apple.com">clintw@apple.com</a>><br><b>Date: </b>Saturday, 3 February 2024 at 01:13<br><b>To: </b>Martijn Katerbarg <<a href="mailto:martijn.katerbarg@sectigo.com">martijn.katerbarg@sectigo.com</a>>, ServerCert CA/BF <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>><br><b>Subject: </b>Re: [Servercert-wg] [Discussion Period Begins]: SC-69 Clarify router and firewall logging requirements</span><span lang=EN-US><o:p></o:p></span></p></div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Hi Martijn,</span><span lang=EN-US><o:p></o:p></span></p><div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p></div><div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Thanks for sending this out for discussion. Just a few comments at this point:</span><span lang=EN-US><o:p></o:p></span></p></div><div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p></div><ol style='margin-top:0cm' start=1 type=1><li class=MsoNormal style='mso-list:l3 level1 lfo6'><span lang=EN-US style='font-size:11.0pt'>I’m not sure the wording "Router and firewall activities" is considered an unspecified term, and leaves the exact definition and scope up to the CA, however” is necessary or even really helpful. I think it would be clearer to introduce Section 5.4.1.1 with something like “Logging of router and firewall activities necessary to meet the requirements of Section 5.4.1, Subsection 3.6 MUST at a minimum include:”</span><span lang=EN-US> <o:p></o:p></span></li></ol><ol style='margin-top:0cm' start=1 type=1><ul style='margin-top:0cm' type=circle><li class=MsoNormal style='mso-list:l10 level2 lfo7'><span lang=EN-US style='font-size:11.0pt'>I’m not sold on the “Subsection” part, but I don’t recall if we have good semantics established for referencing the numbered paragraphs/sections under a Section heading.</span><span lang=EN-US><o:p></o:p></span></li></ul></ol><ol style='margin-top:0cm' start=2 type=1><li class=MsoNormal style='mso-list:l8 level1 lfo8'><span lang=EN-US style='font-size:11.0pt'>I think the entire section including and under "Logging of router and firewall activities SHOULD NOT include:” should be removed. </span><span lang=EN-US> <o:p></o:p></span></li></ol><ol style='margin-top:0cm' start=2 type=1><ul style='margin-top:0cm' type=circle><li class=MsoNormal style='mso-list:l9 level2 lfo9'><span lang=EN-US style='font-size:11.0pt'>The first item listed seems overly broad (arguably, imo, even covering the “inbound and outbound” connections of the second item) and so making it a SHOULD NOT seems too strong a recommendation.</span><span lang=EN-US><o:p></o:p></span></li><li class=MsoNormal style='mso-list:l9 level2 lfo9'><span lang=EN-US style='font-size:11.0pt'>The second item seems counterintuitive and difficult to implement correctly+consistently. It could be read as something like “don’t log unless you know you’re being exploited”, which doesn’t sound like a recommendation we should be making (especially in the context of post-incident data analysis).</span><span lang=EN-US><o:p></o:p></span></li><li class=MsoNormal style='mso-list:l9 level2 lfo9'><span lang=EN-US style='font-size:11.0pt'>Neither of these recommendations seems necessary to accomplish the goals of additional clarity and specificity of what MUST be logged.</span><span lang=EN-US><o:p></o:p></span></li></ul></ol><ol style='margin-top:0cm' start=3 type=1><li class=MsoNormal style='mso-list:l2 level1 lfo10'><span lang=EN-US style='font-size:11.0pt'>The concluding sentence "CAs are encouraged to recommend additional MUST and SHOULD NOT requirements through an email to <a href="mailto:questions@cabforum.org">questions@cabforum.org</a>, for future discussion within the appropriate Working Group.” stands out as I think it’s the only such “encouragement” in the BRs. I don’t think that makes it bad or that it should be removed, but I’m also not sure how valuable it is to the BRs as a policy. I admit that may be because I view this encouragement as fundamental to membership and participation in the CA/B Forum at all — every member, regardless of type, should feel welcome and encouraged to recommend changes to any of the CA/B Forum documents. But we don’t say that anywhere, so maybe this is a good start?</span><span lang=EN-US><o:p></o:p></span></li></ol><div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p></div><div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Cheers!</span><span lang=EN-US><o:p></o:p></span></p></div><div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>-Clint</span><span lang=EN-US><o:p></o:p></span></p></div><div><p class=MsoNormal style='margin-bottom:12.0pt'><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>On Jan 29, 2024, at 10:30 AM, Martijn Katerbarg via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>> wrote:</span><span lang=EN-US><o:p></o:p></span></p></div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><div><p><strong><span lang=EN-US style='font-size:9.0pt;font-family:"Calibri",sans-serif'>Summary: </span></strong><span lang=EN-US><o:p></o:p></span></p><p id=bkmrk-this-ballot-aims-to-><span lang=EN-US style='font-size:9.0pt;font-family:Helvetica'>This ballot aims to clarify what data needs to be logged as part of the "Firewall and router activities" logging requirement in the Baseline Requirements.</span><span lang=EN-US><o:p></o:p></span></p><p id=bkmrk-this-pull-request-pr><span lang=EN-US style='font-size:9.0pt;font-family:Helvetica'>This ballot is proposed by Martijn Katerbarg (Sectigo) and endorsed by Daniel Jeffery (Fastly) and Ben Wilson (Mozilla).</span><span lang=EN-US><o:p></o:p></span></p><p id="bkmrk-%E2%80%94-motion-begins-%E2%80%94"><span lang=EN-US style='font-size:9.0pt;font-family:Helvetica'>--- Motion Begins ---</span><span lang=EN-US><o:p></o:p></span></p><p id=bkmrk-this-ballot-modifies><span lang=EN-US style='font-size:9.0pt;font-family:Helvetica'>This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates" ("Baseline Reuqirements"), based on Version 2.0.2.</span><span lang=EN-US><o:p></o:p></span></p><p id=bkmrk-modify-the-baseline-><span lang=EN-US style='font-size:9.0pt;font-family:Helvetica'>MODIFY the Baseline Requirements as specified in the following Redline:<span class=apple-converted-space> </span><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furl.avanan.click%2Fv2%2F___https%3A%2Fgithub.com%2Fcabforum%2Fservercert%2Fcompare%2F41f01640748fa612386f8b1a3031cd1bff3d4f35...807675c91c8500157b0ffd58ab3a40b0b17075e5___.YXAzOmRpZ2ljZXJ0OmE6bzpkZDMwYTE1OTM3NTE0N2FmZTg5YjA4MWU1ODY4MTcyNTo2OmM3N2E6YjkwMzgyMzVlN2MwNTA3NDZiMGY0ZTMxOTllODlkMmRkNWE0MzJhYTFjYTk2Njg1Y2JiNGZiZjIwODBjNzU3YzpoOkY&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7C03dcbf3fd9a44f66ac9d08dc275d915c%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638428530079070309%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=bVzZU1NSVX8vDKqG6Y1CYt5dTJFI5C0Byhkm73rUCM4%3D&reserved=0" title="Protected by Avanan: https://github.com/cabforum/servercert/compare/41f01640748fa612386f8b1a3031cd1bff3d4f35...807675c91c8500157b0ffd58ab3a40b0b17075e5"><span style='color:#0563C1'>https://github.com/cabforum/servercert/compare/41f01640748fa612386f8b1a3031cd1bff3d4f35...807675c91c8500157b0ffd58ab3a40b0b17075e5</span></a></span><span lang=EN-US><o:p></o:p></span></p><p id=bkmrk-----motion-ends----><span lang=EN-US style='font-size:9.0pt;font-family:Helvetica'>--- Motion Ends ---</span><span lang=EN-US><o:p></o:p></span></p><p id=bkmrk-this-ballot-proposes><span lang=EN-US style='font-size:9.0pt;font-family:Helvetica'>This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:</span><span lang=EN-US><o:p></o:p></span></p><p id="bkmrk-discussion-%2811%2B-days"><span lang=EN-US style='font-size:9.0pt;font-family:Helvetica'>Discussion (at least 7 days)</span><span lang=EN-US><o:p></o:p></span></p><ol start=1 type=1><li class=null style='mso-list:l0 level1 lfo11'><span lang=EN-US>Start time: 2024-01-2</span><span lang=SV>9</span><span class=apple-converted-space><span lang=EN-US> </span></span><span lang=EN-US>1</span><span lang=SV>8</span><span lang=EN-US>:</span><span lang=SV>3</span><span lang=EN-US>0:00 UTC<o:p></o:p></span></li><li class=null style='mso-list:l0 level1 lfo11'><span lang=EN-US>End time: not before 2024-02-05 18:30:00 UTC<o:p></o:p></span></li></ol><p id="bkmrk-vote-for-approval-%287"><span lang=EN-US style='font-size:9.0pt;font-family:Helvetica'>Vote for approval (7 days)</span><span lang=EN-US><o:p></o:p></span></p><ol start=1 type=1><li class=null style='mso-list:l4 level1 lfo12'><span lang=EN-US>Start time: TBD<o:p></o:p></span></li><li class=null style='mso-list:l4 level1 lfo12'><span lang=EN-US>End time: TBD<o:p></o:p></span></li></ol><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:9.0pt;font-family:Helvetica'>_______________________________________________<br>Servercert-wg mailing list<br></span><span lang=EN-US style='font-size:11.0pt'><a href="mailto:Servercert-wg@cabforum.org"><span style='font-size:9.0pt;font-family:Helvetica;color:#0563C1'>Servercert-wg@cabforum.org</span></a></span><span lang=EN-US style='font-size:9.0pt;font-family:Helvetica'><br></span><span lang=EN-US style='font-size:11.0pt'><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Furl.avanan.click%2Fv2%2F___https%3A%2Flists.cabforum.org%2Fmailman%2Flistinfo%2Fservercert-wg___.YXAzOmRpZ2ljZXJ0OmE6bzpkZDMwYTE1OTM3NTE0N2FmZTg5YjA4MWU1ODY4MTcyNTo2OmM3MTc6M2Q2YTM5NDYxNjVhNDM1NGNkMmZhN2RmOGFkMjJhYzhkMjM2ODQ2M2VjYzgyN2ZhMDQyZjcxNGNjZTM0ZDIwYTpoOkY&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7C03dcbf3fd9a44f66ac9d08dc275d915c%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638428530079080360%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=SqPvOZBQY0ZoclI4aJqDf7bFWJpmspdKKqTxSd18l3o%3D&reserved=0" title="Protected by Avanan: https://lists.cabforum.org/mailman/listinfo/servercert-wg"><span style='font-size:9.0pt;font-family:Helvetica;color:#0563C1'>https://lists.cabforum.org/mailman/listinfo/servercert-wg</span></a></span><span lang=EN-US><o:p></o:p></span></p></div></blockquote></div><div id=mail-editor-reference-message-container><div><div><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'> </span><span lang=EN-US><o:p></o:p></span></p></div></div></div></div></div></div></div></div></div></div></body></html>