<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Wayne,<div><br></div><div>Thank you for carrying this work item forward. I have a few concerns regarding the proposed removal of Debian weak key checking, outlined below.</div><div><br></div><div>I don’t believe there has been sufficient explanation or data presented to justify the removal of the requirement to check for Debian weak keys. It seems to me there are feasible methods for CAs to continue performing this check. Similar to what Martijn has pointed out, the reasoning provided is lacking (hasty generalization, fallacy of composition, etc.). </div><div><br></div><div>I don’t believe a compromise where Debian weak keys only need be checked for specific key sizes addresses the core issue, unless tied together with a restriction from accepting key sizes which are not included in such a list (which I do see as reasonable and something I’m under the impression is already being done by some CAs).</div><div><br></div><div>The removal of this check seems to shift a burden currently placed on CAs to a risk (long assumed resolved) for Relying Parties and Subscribers. From my reading of the ballot, the requirement that a CA revoke Certificates with Debian weak keys remains in effect, serving only to remove the pre-issuance “blocking” requirement, but retaining an expectation that certificates are checked post-issuance based on the CA’s awareness of this method of compromising a Private Key; this generally seems a significantly worse experience for Subscribers. Have I missed something regarding the intent of the changes in this regard?</div><div><br></div><div>There have been incidents involving certificates issued to Debian weak keys in recent years; some CAs have indicated that they don’t receive Debian weak keys in requests, but evidence exists to the contrary for the ecosystem as a whole.</div><div><br></div><div>Thank you!</div><div>-Clint<br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Mar 5, 2024, at 12:01 PM, Wayne Thayer via Servercert-wg <servercert-wg@cabforum.org> wrote:</div><br class="Apple-interchange-newline"><div><div dir="ltr"><div>Now that everyone should be back from the F2F meeting, I'd like to get back to this ballot. It currently removes all requirements for Debian weak key checks. I'll plan to begin the formal discussion period in a few days unless there are more responses to this thread.</div><div><br></div><div>Thanks,</div><div><br></div><div>Wayne<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Feb 26, 2024 at 1:24 PM Wayne Thayer via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Martijn,</div><div><br></div><div>The purpose of the first weak keys ballot was to make the requirements more explicit. If I correctly understand your proposal, by removing the exception for Debian keys from this ballot, it does the opposite. The only compromise I can see is to require checking for Debian weak keys but only for specific key sizes, e.g. 2048, 3072, and 4096. That would somewhat reduce the burden of these checks, and I'd be happy to go that route if there is consensus for doing so (with approval of the endorsers, of course). I would appreciate input from other members on the preferred approach to Debian weak key checking requirements.<br></div><div><br></div><div>Thanks,</div><div><br></div><div>Wayne<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Feb 25, 2024 at 12:15 AM Martijn Katerbarg <<a href="mailto:martijn.katerbarg@sectigo.com" target="_blank">martijn.katerbarg@sectigo.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div lang="en-SE"><div><p class="MsoNormal"><span style="font-size:11pt">Thanks Wayne,<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">></span><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:rgb(33,33,33)">- The Debian vulnerability is more than 15 years old. If an Applicant submits a Debian weak key at this point, they almost certainly have bigger security issues.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:rgb(33,33,33)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:rgb(33,33,33)">This is the bit I have problems with. Just because the applicant (probably) has bigger security issues, doesn’t mean we should be putting relying parties at even further risk. If that’s our measure stick, we might as wel allow MD5 again because only insecure systems would generate it.<br><br>Just this year I’ve seen at least one applicant trying to submit a debian weak key for order (which obviously got blocked).<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:rgb(33,33,33)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:rgb(33,33,33)">I really like what was done with this ballot, except for this bit. I’d even be alright with removing the debian weak key check requirement itself. But calling it out explicitly as an excempt, I feel is a step too much.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:rgb(33,33,33)"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:12pt;font-family:"Aptos",sans-serif;color:rgb(33,33,33)">Regards,<br><br>Martijn</span><span style="font-size:11pt"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><div id="m_8930537877421876392m_-1570543912524971772mail-editor-reference-message-container"><div><div style="border-width:1pt medium medium;border-style:solid none none;border-color:rgb(181,196,223) currentcolor currentcolor;padding:3pt 0cm 0cm"><p class="MsoNormal" style="margin-bottom:12pt"><b><span style="font-size: 12pt; font-family: Aptos, sans-serif;">From: </span></b><span style="font-size: 12pt; font-family: Aptos, sans-serif;">Wayne Thayer <<a href="mailto:wthayer@gmail.com" target="_blank">wthayer@gmail.com</a>><br><b>Date: </b>Friday, 23 February 2024 at 17:21<br><b>To: </b>Martijn Katerbarg <<a href="mailto:martijn.katerbarg@sectigo.com" target="_blank">martijn.katerbarg@sectigo.com</a>><br><b>Cc: </b>CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>><br><b>Subject: </b>Re: [Servercert-wg] Compromised/Weak Keys Ballot Proposal<u></u><u></u></span></p></div><div style="border:1pt solid black;padding:2pt"><p class="MsoNormal" style="line-height:12pt;background:rgb(250,250,3)"><span style="">CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.<u></u><u></u></span></p></div><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><div><div><div><p class="MsoNormal"><span style="font-size:11pt">Martijn,<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">I would summarize the reasoning for removing the Debian requirements as follows:<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">- CAs would prefer the greater clarity that would be provided by the weak keys ballot that failed last year.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">- However, some CAs were of the opinion that the prior ballot imposed more explicit requirements for Debian weak key checking rather than just clarifying existing requirements. The "new" requirements were viewed as burdensome.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">- The Debian vulnerability is more than 15 years old. If an Applicant submits a Debian weak key at this point, they almost certainly have bigger security issues.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">- So the cost of these requirements outweighs the benefits at this point in time.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">I included a few links to the discussion during the prior balot's voting period, and there was also discussion at the last SCWG teleconference that should be captured in the minutes.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">Thanks,<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">Wayne<u></u><u></u></span></p></div></div><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><div><div><p class="MsoNormal"><span style="font-size:11pt">On Fri, Feb 23, 2024 at 2:19 AM Martijn Katerbarg <<a href="mailto:martijn.katerbarg@sectigo.com" target="_blank">martijn.katerbarg@sectigo.com</a>> wrote:<u></u><u></u></span></p></div><blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;border-color:currentcolor currentcolor currentcolor rgb(204,204,204);padding:0cm 0cm 0cm 6pt;margin-left:4.8pt;margin-right:0cm"><div><div><div><p class="MsoNormal"><span style="font-size:11pt">Wayne, <br><br>Apologies if I’ve missed something in discussions, but why exactly are we removing the Debian Weak Keys language, and even explicitly mentioned that CAs do not need to check for them (anymore)?<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><br>Regards,<br><br>Martijn<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p><div id="m_8930537877421876392m_-1570543912524971772m_-6864181456797876892mail-editor-reference-message-container"><div><div style="border-width:1pt medium medium;border-style:solid none none;padding:3pt 0cm 0cm;border-color:currentcolor"><p class="MsoNormal" style="margin-bottom:12pt"><b><span style="font-size: 12pt; font-family: Aptos, sans-serif;">From: </span></b><span style="font-size: 12pt; font-family: Aptos, sans-serif;">Servercert-wg <<a href="mailto:servercert-wg-bounces@cabforum.org" target="_blank">servercert-wg-bounces@cabforum.org</a>> on behalf of Wayne Thayer via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>><br><b>Date: </b>Thursday, 22 February 2024 at 20:01<br><b>To: </b>CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>><br><b>Subject: </b>Re: [Servercert-wg] Compromised/Weak Keys Ballot Proposal</span><span style="font-size:11pt"><u></u><u></u></span></p></div><div style="border:1pt solid black;padding:2pt"><p class="MsoNormal" style="line-height:12pt;background:rgb(250,250,3)"><span style="font-size: 11pt;">CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and know the content is safe.</span><span style="font-size:11pt"><u></u><u></u></span></p></div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p><div><div><div><p class="MsoNormal"><span style="font-size:11pt">I am seeking a second endorser for this proposal. Below is a draft of the ballot language.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">Thanks,<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">Wayne<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">================================<u></u><u></u></span></p></div><p class="MsoNormal"><span style="font-size:11pt">**Ballot SC-XX: Compromised / Weak Keys**<br><br>This ballot updates BR section 6.1.1.3 to address two issues:<br><br>First, the requirements placed on CAs to reject a certificate request if they have been “made aware” that the key pair is compromised is vague and open-ended in regard to how CAs may be “made aware”. This ballot specifies that CAs be “made aware” via their problem reporting mechanism.<br><br>Second, this ballot reintroduces the language from [failed] ballot SC-59: Weak Key Guidance. However, based on feedback received during the discussion and voting period for that ballot, Debian weak key checks are now explicitly out of scope.<br><br>This ballot is proposed by Wayne Thayer (Fastly) and endorsed by Brittany Randall (GoDaddy) and <someone else( )>. You can view and comment on the github pull request representing this ballot here: <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fwthayer%2Fservercert%2Fpull%2F1%2Ffiles&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020758949433%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=y347VmkNTHYxd6UGV97VTgLN52Ia4zIQccZcHw9NWX8%3D&reserved=0" target="_blank">https://github.com/wthayer/servercert/pull/1/files</a> <br><br>The preceding discussions can be seen here:<br><br>* This ballot: <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fpipermail%2Fservercert-wg%2F2024-February%2F004195.html&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020758961843%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=mmIZgDRBOl0dJO8%2BJ3%2B8PUMqWUhvUMiKAiocwwAvSqE%3D&reserved=0" target="_blank">https://lists.cabforum.org/pipermail/servercert-wg/2024-February/004195.html</a> <br>* The prior weak keys ballot: <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fpipermail%2Fservercert-wg%2F2023-July%2F003820.html&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020758972257%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=l0IUg9vTVPvAvrRtoyO9G8%2Bp%2B%2BdS%2BPuwcf29CpZJuX8%3D&reserved=0" target="_blank">https://lists.cabforum.org/pipermail/servercert-wg/2023-July/003820.html</a> and <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fpipermail%2Fservercert-wg%2F2023-July%2F003857.html&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020758982921%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=2XiwEbzsjI0BEVAQFR3p9ut46n0MB9QxkleNq3UwbbI%3D&reserved=0" target="_blank">https://lists.cabforum.org/pipermail/servercert-wg/2023-July/003857.html</a><br>* The “made aware” language in <a href="https://nam04.safelinks.protection.outlook.com/?url=http%3A%2F%2F6.1.1.3%2F&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020758991319%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=G%2BXG6nRJouXExcZvBaW03X7zOj775%2BzOa5jRsq%2BBi0g%3D&reserved=0" target="_blank">6.1.1.3</a>: <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fpipermail%2Fservercert-wg%2F2023-July%2F003902.html&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020758998243%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=p6JDEG6A%2FNAQHtqXD0Hvi7ddwSRcn36FwxLppE5fzOY%3D&reserved=0" target="_blank">https://lists.cabforum.org/pipermail/servercert-wg/2023-July/003902.html</a><br><br><br>--- Motion Begins ---<br><br>This ballot modifies the "Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates" ("Baseline Requirements") based on Version 2.X.X<br><br>MODIFY the Baseline Requirements as specified in the following redline: <Immutable redline link><br><br>--- Motion Ends ---<br><br>Discussion (at least 7 days):<br><br>- Start: TBD UTC<br>- End: TBD UTC<br><br>Vote for approval (7 days):<br><br>- Start: TBD UTC<br>- End: TBD UTC<u></u><u></u></span></p></div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p><div><div><p class="MsoNormal"><span style="font-size:11pt">On Mon, Feb 12, 2024 at 6:12 PM Wayne Thayer via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<u></u><u></u></span></p></div><blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)"><div><div><p class="MsoNormal"><span style="font-size:11pt">Thank you fo the feedback Aaron. I agree with both points you made in the PR and have updated it to reflect your suggestions.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">- Wayne<u></u><u></u></span></p></div></div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p><div><div><p class="MsoNormal"><span style="font-size:11pt">On Mon, Feb 12, 2024 at 12:27 PM Aaron Gable <<a href="mailto:aaron@letsencrypt.org" target="_blank">aaron@letsencrypt.org</a>> wrote:<u></u><u></u></span></p></div><blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)"><div><p class="MsoNormal"><span style="font-size:11pt">Thank you Wayne! I think this gets close to the sweet spot for me, personally. I've left two small comments on the ballot, but on the whole I think I like this approach. <u></u><u></u></span></p><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">Thanks again,<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">Aaron<u></u><u></u></span></p></div></div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p><div><div><p class="MsoNormal"><span style="font-size:11pt">On Mon, Feb 12, 2024 at 8:18 AM Wayne Thayer via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<u></u><u></u></span></p></div><blockquote style="border-width:medium medium medium 1pt;border-style:none none none solid;padding:0cm 0cm 0cm 6pt;margin:5pt 0cm 5pt 4.8pt;border-color:currentcolor currentcolor currentcolor rgb(204,204,204)"><div><div><p class="MsoNormal"><span style="font-size:11pt">Following up from the last SCWG teleconference, I've reviewed the feedback from the discussion [1] and voting [2] periods for ballot SC-59 Weak Key Guidance, along with the prior discussions on the "made aware" language in section 6.1.1.3 [3] and I would like to propose the following Baseline Requirements improvements:<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">* Scope the 6.1.1.3 "made aware" language to "made aware via the CA's documented problem reporting mechanism". This addresses the concern that I raised by limiting how a CA can be "made aware". [4]<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">* Remove the Debian requirements from the prior weak keys ballot and replace them with language that excludes Debian weak keys. Otherwise use the language from the prior ballot, with the exception of a new effective date. This consolidates feedback that CAs do desire the clarity that would have been provided by the prior ballot, but many believe that the burden for rejecting Debian weak keys exceeds the value of doing so at this point in time.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">Here's the result: <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fwthayer%2Fservercert%2Fpull%2F1%2Ffiles&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020759006423%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=LkKjXvOVZxrCaHNlq0R66Gk79H2ExvagS0f57GGCGRU%3D&reserved=0" target="_blank">https://github.com/wthayer/servercert/pull/1/files</a><u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">Note that, while there has been discussion about completely removing weak key checking requirements, there does not appear to be a consensus to do so.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">I would appreciate everyone's feedback on the proposal, and I am also seeking endorsers.<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">Thanks,<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">Wayne<u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">[1] <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fpipermail%2Fservercert-wg%2F2023-July%2F003820.html&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020759015528%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=y52kg0YII5g%2B2J4JijUL3vsYvuyQ2a6xYVzYLW0zU8Q%3D&reserved=0" target="_blank">https://lists.cabforum.org/pipermail/servercert-wg/2023-July/003820.html</a><u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">[2] <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fpipermail%2Fservercert-wg%2F2023-July%2F003857.html&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020759025615%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=KqzTrHTaVkxw0iZjZVcGvvVVXT3j8DQXY1oPdEJpn%2Bo%3D&reserved=0" target="_blank">https://lists.cabforum.org/pipermail/servercert-wg/2023-July/003857.html</a><u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">[3] <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fpipermail%2Fservercert-wg%2F2023-July%2F003902.html&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020759035198%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=TXqyTYQWR%2BtEazAODiQxeVA18JMCZ5oicRr6fgVMvqU%3D&reserved=0" target="_blank">https://lists.cabforum.org/pipermail/servercert-wg/2023-July/003902.html</a><u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt">[4] <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcabforum%2Fservercert%2Fissues%2F442&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020759044714%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=uUSUQfGMnBSY8Vcg8BmHiYEcvQia8J0gouKun3hufEU%3D&reserved=0" target="_blank">https://github.com/cabforum/servercert/issues/442</a><u></u><u></u></span></p></div><div><p class="MsoNormal"><span style="font-size:11pt"> <u></u><u></u></span></p></div></div><p class="MsoNormal"><span style="font-size:11pt">_______________________________________________<br>Servercert-wg mailing list<br><a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fmailman%2Flistinfo%2Fservercert-wg&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020759053458%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=P398WJJFnIAmvILIBIr5sHqdDj0dz4KJJN7tHCMd5MA%3D&reserved=0" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><u></u><u></u></span></p></blockquote></div></blockquote></div><p class="MsoNormal"><span style="font-size:11pt">_______________________________________________<br>Servercert-wg mailing list<br><a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br><a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fmailman%2Flistinfo%2Fservercert-wg&data=05%7C02%7Cmartijn.katerbarg%40sectigo.com%7Cb4219e59685b4f4cb47108dc348b733a%7C0e9c48946caa465d96604b6968b49fb7%7C0%7C0%7C638443020759062015%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=nwZCS32B7L%2FYv32r3%2F2PZOE%2BcEokJq6cz3gsHQPTt%2Fs%3D&reserved=0" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><u></u><u></u></span></p></blockquote></div></div></div></div></div></div></div></blockquote></div></div></div></div></div></div></div></blockquote></div>
_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><br>
</blockquote></div>
_______________________________________________<br>Servercert-wg mailing list<br>Servercert-wg@cabforum.org<br>https://lists.cabforum.org/mailman/listinfo/servercert-wg<br></div></blockquote></div><br></div></body></html>