<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:12.0pt;color:black;mso-ligatures:none">Hello all,<br>
<br>
Here is a draft ballot that proposes changes to section 3.2.2.4.7 of the TLS Server Certificate BRs that make it clear that CAs are authorized to operate domains for the purpose of assisting Applicants with performing DNS validation. <br>
<br>
I am seeking two endorsers. </span><span style="font-size:12.0pt;mso-ligatures:none"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-ligatures:none"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:12.0pt;color:black;mso-ligatures:none">Note:</span></b><span style="font-size:12.0pt;color:black;mso-ligatures:none"> Redline link will be replaced with the immutable commit link after two endorsers have been secured<br>
<br>
Please provide any input/feedback that you may have on the PR linked below.<br>
<br>
Thanks,<br>
Michael Slaughter of Amazon Trust Services<br>
<br>
-----------------<br>
<br>
Purpose of Ballot SC-XX<br>
This ballot will provide updates to the Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates related to section 3.2.2.4.7 "DNS Change". This ballot makes it clear that CAs are authorized to operate domains for the
purpose of assisting applicants with domain control verification under method 3.2.2.4.7.<br>
<br>
Notes:<br>
* This ballot defines a "Canonical Authorization Domain Name". <br>
* In the CNAME record: _somethingsomething.example.com. IN CNAME accountbindingid.cadomain.com<br>
* _somethingsomething.example.com is an underscore prefixed Authorization Domain Name. <br>
* accountbindingid.cadomain.com is the Canonical Authorization Domain Name. <br>
* This ballot makes it clear that CAs are authorized to operate domains for the purpose of assisting applicants with domain control verification under method 3.2.2.4.7 and adds requirements for the practice.<br>
* As observed with other ballots in the past, minor administrative updates must be made to the proposed ballot text before publication such that the appropriate Version # and Change History are accurately represented (e.g., to indicate these changes will be
represented in Version 2.0.4).<br>
* This ballot does not modify the “Guidelines for the Issuance and Management of Extended Validation Certificates”. <br>
<br>
The following motion has been proposed by Michael Slaughter of Amazon, and endorsed by XX of XX and XX of XX.<br>
<br>
<b>— Motion Begins —</b><br>
<br>
This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates” (“Baseline Requirements”), based on Version 2.0.4.<br>
<br>
MODIFY the Baseline Requirements as specified in the following Redline:<br>
<br>
Here is a link to the GitHub Redline: <a href="https://github.com/cabforum/servercert/pull/501/files">
https://github.com/cabforum/servercert/pull/501/files</a><br>
<br>
<b>— Motion Ends —</b><br>
<br>
This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:<br>
<br>
Discussion (7+ days)<br>
• Start time: XXXX-XX-XX 22:00:00 UTC<br>
• End time: XXXX-XX-XX 22:00:00 UTC<br>
<br>
Vote for approval (7 days)<br>
• Start time: XXXX-XX-XX 22:00:00 UTC<br>
• End time: XXXX-XX-XX 22:00:00 UTC</span><span style="mso-ligatures:none"><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>