<div dir="ltr"><span id="gmail-docs-internal-guid-637ec2c6-7fff-65f6-1dd9-95326036d077"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif" style="">Hi Christophe,</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Answers to your questions are listed below, flagged with a “CRP Response" prefix. </font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><span style="color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Due to expected formatting and readability issues commonly observed with the mail archive (i.e., poorly formatted bulleted lists), a copy of this content is available in doc form </span><a href="https://docs.google.com/document/d/11V43IrkwGbDvL69hxm2smukJfgZH9Qs0md4CPNdbViw/edit" style="text-decoration-line:none"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">here</span></a><span style="color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">. The doc copy is only intended to improve readability.</span></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-weight:700;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Case 1: DNS TXT with correct expected TXT value but different other TXT values present on remote perspective</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Suppose the following responses from:</font></span></p><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Primary perspective: TXT with 2 records: a=1; c=2</font></span></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Remote perspective: TXT with 2 records: a=1; c=3</font></span></p></li></ul><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif"> </font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">If the expected random value is a=1, is the corroboration limited to only the “a” TXT record, and not impacted by a difference to the “c” record?</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif"> </font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Our understanding is yes due to the statement “can corroborate the outcomes determined by the Primary Network Perspective”, where that outcome would be “was the primary perspective able to retrieve a TXT record a=1”.</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><span style="color:rgb(74,134,232);background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">CRP Response: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Yes, your understanding is correct. The observation of c=3 from the remote perspective has no bearing on the corroboration of a=1.</span></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif"> </font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-weight:700;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Case 2: DNS TXT with corroboration between remote perspectives only</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Suppose the following responses from:</font></span></p><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Primary perspective: no TXT records</font></span></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Remote perspective 1: TXT with expected value</font></span></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Remote perspective 2: TXT with expected value</font></span></p></li></ul><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif"> </font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Suppose the # of allowed non-corroborations is 1 (the primary perspective being the non-corroborating instance). Is our understanding correct that “corroboration” is intended to confirm the value of the primary perspective, meaning that if there was no success obtaining the value on the primary perspective, it can not be corroborated? This is based on the statement “To count as corroborating, a Network Perspective MUST observe the same challenge information (i.e. Random Value or Request Token) as the Primary Network Perspective.”</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif"> </font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Or is the intention to consider the 3 nodes as the quorum and since remote perspective 1 and 2 corroborate, the expected value is verified successfully? In other words, is the quorum including all network perspectives, including the primary, or only the remote perspectives?</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><span style="color:rgb(74,134,232);background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">CRP Response: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">MPIC intends to corroborate the Primary Network Perspective through the use of additional remote network perspectives. The primary perspective shall not be considered part of the quorum. If the primary perspective does not observe a TXT record when it’s otherwise expected, the obligations of 3.2.2.4.7 have not been met and it would be impossible for MPIC to succeed because there is nothing to corroborate. Please remember, MPIC only presents the opportunity to block issuance, it is not considered authoritative for domain authorization or control. If the primary lookup fails, there is no expectation to perform MPIC as it cannot succeed.</span></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif"> </font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-weight:700;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Case 3: CAA returns valid but different Issuer Domain Names from different subdomains</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Suppose the following responses from:</font></span></p><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Primary perspective: </span><a href="http://a.b.c.domain.com/" style="text-decoration-line:none"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">a.b.c.domain.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> returns </span><a href="http://ca.com/" style="text-decoration-line:none"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">ca.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> for CAA</span></font></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Remote perspective 1: </span><a href="http://b.c.domain.com/" style="text-decoration-line:none"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">b.c.domain.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> returns </span><a href="http://ca.net/" style="text-decoration-line:none"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">ca.net</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> for CAA</span></font></p></li></ul><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif"> </font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">And both </span><a href="http://ca.com/" style="text-decoration-line:none"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">ca.com</span></a><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> and </span><a href="http://ca.net/" style="text-decoration-line:none"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">ca.net</span></a><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> are defined by the CA as Issuer Domain Names.</span></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif"> </font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Is the intention of corroboration to only confirm if all network perspectives return a “permission to issue”? Would corroboration also require the contents of the CAA values to match (so </span><a href="http://ca.com/" style="text-decoration-line:none"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">ca.com</span></a><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> and </span><a href="http://ca.net/" style="text-decoration-line:none"><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">ca.net</span></a><span style="background-color:transparent;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> would not corroborate)? Would the difference in path building (primary perspective obtains the result from a.b.c, remote perspective obtains from b.c) result in a non-corroboration result? The statement “regardless of whether the responses from both Perspectives are byte-for-byte identical.” Seems to hint at the contents of the CAA values, but maybe this is not intentional.</span></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><span style="color:rgb(74,134,232);background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">CRP Response:</span><span style="color:rgb(74,134,232);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> </span><span style="color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">To count as corroborating, it is not necessary for the CAA records to match exactly. In your example, we would consider the remote perspective to corroborate the primary perspective’s permission to issue (as in, both the primary and remote network perspectives agree that the CA is permitted to issue). Even though the checks found CAA records at different subdomains and distinct values, each of these CAA record checks yields “permission to issue = true” and only the boolean results of the different checks need to be compared using the quorum policy. Checking in this manner avoids potential false positives related to benign DNS discrepancies.</span></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Exploring other MPIC CAA evaluation scenarios for added clarity and completeness: </font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><span style="color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Note: In all of the following scenarios, assume there is no available re-use data (e.g., afforded by </span><a href="https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463#diff-e0ac1bd190515a4f2ec09139d395ef6a8c7e9e5b612957c1f5a2dea80c6a6cfeR1072" style="text-decoration-line:none"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">line 1072 </span></a><span style="color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">of the compare). </span></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline"><font face="arial, sans-serif">Scenario A:</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Domain to be evaluated:</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> <a href="http://a.b.c.domain.com">a.b.c.domain.com</a></span></font></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Primary perspective:</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> Look up for <a href="http://a.b.c.domain.com">a.b.c.domain.com</a> returns [<a href="http://ca.com">ca.com</a>] for CAA</span></font></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Remote perspective 1: </font></span></p></li><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:circle;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for <a href="http://a.b.c.domain.com">a.b.c.domain.com</a> returns [NO CAA RECORD], walk the tree</font></span></p></li><li dir="ltr" style="list-style-type:circle;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for <a href="http://b.c.domain.com">b.c.domain.com</a> returns [NO CAA RECORD], walk the tree</font></span></p></li><li dir="ltr" style="list-style-type:circle;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for <a href="http://c.domain.com">c.domain.com</a> returns [NO CAA RECORD], walk the tree</font></span></p></li><li dir="ltr" style="list-style-type:circle;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for <a href="http://domain.com">domain.com</a> returns [NO CAA RECORD], walk the tree</font></span></p></li><li dir="ltr" style="list-style-type:circle;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for com returns [NO CAA RECORD]</font></span></p></li><li dir="ltr" style="list-style-type:circle;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">[Evaluation process completed]</font></span></p></li></ul><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Outcome: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">The remote perspective is interpreted as permitting issuance. It </span><span style="color:rgb(56,118,29);background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">counts</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> as corroborating. </span></font></p></li></ul><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline"><font face="arial, sans-serif">Scenario B:</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Domain to be evaluated: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><a href="http://a.b.c.domain.com">a.b.c.domain.com</a></span></font></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Primary perspective:</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> Look up for <a href="http://a.b.c.domain.com">a.b.c.domain.com</a> returns [<a href="http://ca.com">ca.com</a>] for CAA</span></font></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Remote perspective 1:</font></span></p></li><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:circle;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for <a href="http://a.b.c.domain.com">a.b.c.domain.com</a> returns  [NO CAA RECORD], walk the tree</font></span></p></li><li dir="ltr" style="list-style-type:circle;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for <a href="http://b.c.domain.com">b.c.domain.com</a> returns [<a href="http://ca.com">ca.com</a>] for CAA</font></span></p></li><li dir="ltr" style="list-style-type:circle;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">[Evaluation process completed]</font></span></p></li></ul><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Outcome: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">The remote perspective is interpreted as permitting issuance. It </span><span style="color:rgb(56,118,29);background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">counts</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> as corroborating. </span></font></p></li></ul><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline"><font face="arial, sans-serif">Scenario C:</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Domain to be evaluated: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><a href="http://a.b.c.domain.com">a.b.c.domain.com</a></span></font></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Primary perspective: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Look up for <a href="http://a.b.c.domain.com">a.b.c.domain.com</a> returns [<a href="http://ca.com">ca.com</a>] for CAA</span></font></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Remote perspective 1:</font></span></p></li><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:circle;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for <a href="http://a.b.c.domain.com">a.b.c.domain.com</a> returns [NO CAA RECORD], walk the tree</font></span></p></li><li dir="ltr" style="list-style-type:circle;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for <a href="http://b.c.domain.com">b.c.domain.com</a> returns [<a href="http://ca.net">ca.net</a>] for CAA</font></span></p></li><li dir="ltr" style="list-style-type:circle;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">[Evaluation process completed]</font></span></p></li></ul><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Outcome: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">The remote perspective is interpreted as permitting issuance. It </span><span style="color:rgb(56,118,29);background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">counts</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> as corroborating. </span></font></p></li></ul><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif"> </font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline"><font face="arial, sans-serif">Scenario D:</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Domain to be evaluated:</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> <a href="http://a.b.c.domain.com">a.b.c.domain.com</a></span></font></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Primary perspective: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Look up for <a href="http://a.b.c.domain.com">a.b.c.domain.com</a> returns [<a href="http://ca.com">ca.com</a>] for CAA</span></font></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Remote perspective 1:</font></span></p></li><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:circle;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for <a href="http://a.b.c.domain.com">a.b.c.domain.com</a> returns [xyz.tld] for CAA</font></span></p></li><li dir="ltr" style="list-style-type:circle;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">[Evaluation process completed]</font></span></p></li></ul><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Outcome: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">The remote perspective is interpreted as NOT permitting issuance. It </span><span style="color:rgb(255,0,0);background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">DOES NOT</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> count as corroborating. </span></font></p></li></ul><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline"><font face="arial, sans-serif">Scenario E:</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Domain to be evaluated:</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> <a href="http://a.b.c.domain.com">a.b.c.domain.com</a></span></font></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Primary perspective: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Look up for <a href="http://a.b.c.domain.com">a.b.c.domain.com</a> returns <a href="http://ca.com">ca.com</a> for CAA</span></font></p></li><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Remote perspective 1:</font></span></p></li><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:circle;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for <a href="http://a.b.c.domain.com">a.b.c.domain.com</a> returns  [NO CAA RECORD], walk the tree</font></span></p></li><li dir="ltr" style="list-style-type:circle;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Look up for <a href="http://b.c.domain.com">b.c.domain.com</a> returns xyz.tld for CAA</font></span></p></li><li dir="ltr" style="list-style-type:circle;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">[Evaluation process completed]</font></span></p></li></ul><li dir="ltr" style="list-style-type:disc;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><font face="arial, sans-serif"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Outcome:</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> The remote perspective is interpreted as NOT permitting issuance. It </span><span style="color:rgb(255,0,0);background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">DOES NOT </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">count as corroborating. </span></font></p></li></ul><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif">Hope this helps!</font></span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><font face="arial, sans-serif"><br></font></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"><font face="arial, sans-serif" style="">- Ryan</font></span></p></span><br class="gmail-Apple-interchange-newline"></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, May 30, 2024 at 5:55 AM Christophe Bonjean via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-120831664414595822"><div lang="EN-US" style="overflow-wrap: break-word;"><div class="m_-120831664414595822WordSection1"><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">Hi Chris, all,<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">I’d like to discuss a few interpretations related to the scope of corroboration.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><b><span style="font-size:10pt;font-family:Arial,sans-serif">Case 1: DNS TXT with correct expected TXT value but different other TXT values present on remote perspective<u></u><u></u></span></b></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">Suppose the following responses from:<u></u><u></u></span></p><ul style="margin-top:0cm" type="disc"><li class="m_-120831664414595822MsoListParagraph" style="margin-left:0cm"><span style="font-size:10pt;font-family:Arial,sans-serif">Primary perspective: TXT with 2 records: a=1; c=2<u></u><u></u></span></li><li class="m_-120831664414595822MsoListParagraph" style="margin-left:0cm"><span style="font-size:10pt;font-family:Arial,sans-serif">Remote perspective: TXT with 2 records: a=1; c=3<u></u><u></u></span></li></ul><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">If the expected random value is a=1, is the corroboration limited to only the “a” TXT record, and not impacted by a difference to the “c” record? <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">Our understanding is yes due to the statement “can corroborate the outcomes determined by the Primary Network Perspective”, where that outcome would be “was the primary perspective able to retrieve a TXT record a=1”.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><b><span style="font-size:10pt;font-family:Arial,sans-serif">Case 2: DNS TXT with corroboration between remote perspectives only<u></u><u></u></span></b></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">Suppose the following responses from:<u></u><u></u></span></p><ul style="margin-top:0cm" type="disc"><li class="m_-120831664414595822MsoListParagraph" style="margin-left:0cm"><span style="font-size:10pt;font-family:Arial,sans-serif">Primary perspective: no TXT records<u></u><u></u></span></li><li class="m_-120831664414595822MsoListParagraph" style="margin-left:0cm"><span style="font-size:10pt;font-family:Arial,sans-serif">Remote perspective 1: TXT with expected value<u></u><u></u></span></li><li class="m_-120831664414595822MsoListParagraph" style="margin-left:0cm"><span style="font-size:10pt;font-family:Arial,sans-serif">Remote perspective 2: TXT with expected value<u></u><u></u></span></li></ul><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">Suppose the # of allowed non-corroborations is 1 (the primary perspective being the non-corroborating instance). Is our understanding correct that “corroboration” is intended to <i>confirm</i> the value of the primary perspective, meaning that if there was no success obtaining the value on the primary perspective, it can not be corroborated? This is based on the statement “To count as corroborating, a Network Perspective MUST observe the same challenge information (i.e. Random Value or Request Token) as the Primary Network Perspective.”<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">Or is the intention to consider the 3 nodes as the quorum and since remote perspective 1 and 2 corroborate, the expected value is verified successfully? In other words, is the quorum including all network perspectives, including the primary, or only the remote perspectives?<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><b><span style="font-size:10pt;font-family:Arial,sans-serif">Case 3: CAA returns valid but different Issuer Domain Names from different subdomains<u></u><u></u></span></b></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">Suppose the following responses from:<u></u><u></u></span></p><ul style="margin-top:0cm" type="disc"><li class="m_-120831664414595822MsoListParagraph" style="margin-left:0cm"><span style="font-size:10pt;font-family:Arial,sans-serif">Primary perspective: <a href="http://a.b.c.domain.com" target="_blank">a.b.c.domain.com</a> returns <a href="http://ca.com" target="_blank">ca.com</a> for CAA<u></u><u></u></span></li><li class="m_-120831664414595822MsoListParagraph" style="margin-left:0cm"><span style="font-size:10pt;font-family:Arial,sans-serif">Remote perspective 1: <a href="http://b.c.domain.com" target="_blank">b.c.domain.com</a> returns <a href="http://ca.net" target="_blank">ca.net</a> for CAA<u></u><u></u></span></li></ul><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">And both <a href="http://ca.com" target="_blank">ca.com</a> and <a href="http://ca.net" target="_blank">ca.net</a> are defined by the CA as Issuer Domain Names.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">Is the intention of corroboration to only confirm if all network perspectives return a “permission to issue”? Would corroboration also require the contents of the CAA values to match (so <a href="http://ca.com" target="_blank">ca.com</a> and <a href="http://ca.net" target="_blank">ca.net</a> would not corroborate)? Would the difference in path building (primary perspective obtains the result from a.b.c, remote perspective obtains from b.c) result in a non-corroboration result? The statement “regardless of whether the responses from both Perspectives are byte-for-byte identical.” Seems to hint at the contents of the CAA values, but maybe this is not intentional.<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif">Christophe<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:10pt;font-family:Arial,sans-serif"><u></u> <u></u></span></p><div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0cm 0cm"><p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Servercert-wg <<a href="mailto:servercert-wg-bounces@cabforum.org" target="_blank">servercert-wg-bounces@cabforum.org</a>> <b>On Behalf Of </b>Chris Clements via Servercert-wg<br><b>Sent:</b> Monday, May 20, 2024 4:30 PM<br><b>To:</b> CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>><br><b>Subject:</b> [Servercert-wg] Discussion Period Begins - Ballot SC-067 V3: "Require domain validation and CAA checks to be performed from multiple Network Perspectives"<u></u><u></u></span></p></div><p class="MsoNormal"><u></u> <u></u></p><div><p style="margin:0cm"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Purpose of Ballot SC-067 V3</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">This Ballot proposes updates to the <i>Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates</i> (i.e., TLS BRs) related to “Multi-Perspective Issuance Corroboration” (“MPIC”).</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Background</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- MPIC refers to performing domain validation and CAA checks from multiple Network Perspectives before certificate issuance, as described within the Ballot for the applicable validation methods in TLS BR Sections 3.2.2.4 and 3.2.2.5.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Not all methods described in TLS BR Sections 3.2.2.4 and 3.2.2.5 will require using MPIC.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- This work was most recently motivated by research presented at Face-to-Face 58 [1] by Princeton University, but has been discussed for years prior as well.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- The goal of this proposal is to make it more difficult for adversaries to successfully launch equally-specific prefix attacks against the domain validation processes described in the TLS BRs.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Additional background information can be found in an update shared at Face-to-Face 60 [2].</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Benefits of Adoption</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Recent publicly-documented attacks have used BGP hijacks to fool domain control validation and obtain malicious certificates, which led to the impersonation of HTTPS websites [3][</span><span style="font-family:Arial,sans-serif;color:black">4</span><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">].</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Routing security defenses (e.g., RPKI) can mitigate the risk of global BGP attacks, but localized, equally-specific BGP attacks still pose a significant threat to the Web PKI [5][6].</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Corroborating domain control validation checks from multiple network perspectives (i.e., MPIC) spread across the Internet substantially reduces the threat posed by equally-specific BGP attacks, ensuring the integrity of domain validation and issuance decisions [5][7][8].</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Existing deployments of MPIC at the scale of millions of certificates a day demonstrate the feasibility of this technique at Internet scale [7][9].</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Intellectual Property (IP) Disclosure</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- While not a Server Certificate Working Group Member, researchers from Princeton University presented at Face-to-Face 58, provided academic expertise, and highlighted publicly-available peer-reviewed research to support Members in drafting this ballot.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- The Princeton University researchers indicate that they have not filed for any patents relating to their MPIC work and do not plan to do so in the future.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Princeton University has indicated that it is unable to agree to the CA/Browser Forum IPR agreement because it could encumber inventions invented by researchers not involved in the development of MPIC or with the CA/B Forum.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Princeton University has instead provided the attached IPR statement. Pursuant to the IPR statement, Princeton University has granted a worldwide royalty free license to the intellectual property in MPIC developed by the researchers and has made representations regarding its lack of knowledge of any other Princeton intellectual property needed to implement MPIC.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- The attached IPR statement has not changed since disclosed in Discussion Round 1.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:black">- For clarity, Princeton University’s IPR statement is NOT intended to replace the Forum’s IPR agreement or allow Princeton to participate in the Forum in any capacity.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:black">- Members seeking legal advice regarding this ballot should consult their own counsel.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Proposal Revision History</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Pre-Ballot Release #1 (work team artifacts and broader Validation Subcommittee collaboration) [10]</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Pre-Ballot Release #2 [11]</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Previous versions of this Ballot</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)">-</span><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> Ballot Release #1 [12] (comparing Version 2 to Version 1) [13]. Note, some of the changes represented in the comparison are updates made by other ballots that have since passed (e.g., SC-069).</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Ballot Release #2 [14] (comparing Version 3 to Version 2) [15]. Note, some of the changes represented in the comparison are updates made by other ballots that have since passed (e.g., SC-072).</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">References</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[1] </span><a href="https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-vantage-points.pdf" target="_blank"><span style="font-family:Arial,sans-serif">https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-vantage-points.pdf</span></a><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[2] </span><a href="https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=drive_link" target="_blank"><span style="font-family:Arial,sans-serif">https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=drive_link</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[3] </span><a href="https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600" target="_blank"><span style="font-family:Arial,sans-serif">https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[4] </span><a href="https://www.coinbase.com/blog/celer-bridge-incident-analysis" target="_blank"><span style="font-family:Arial,sans-serif">https://www.coinbase.com/blog/celer-bridge-incident-analysis</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[5] </span><a href="https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski" target="_blank"><span style="font-family:Arial,sans-serif">https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">  </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[6] </span><a href="https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf" target="_blank"><span style="font-family:Arial,sans-serif">https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[7] </span><a href="https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee" target="_blank"><span style="font-family:Arial,sans-serif">https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[8] </span><a href="https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee" target="_blank"><span style="font-family:Arial,sans-serif">https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[9] </span><a href="https://security.googleblog.com/2023/05/google-trust-services-acme-api_0503894189.html" target="_blank"><span style="font-family:Arial,sans-serif">https://security.googleblog.com/2023/05/google-trust-services-acme-api_0503894189.html</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[10] </span><a href="https://github.com/ryancdickson/staging/pull/6" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/ryancdickson/staging/pull/6</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[11] </span><a href="https://github.com/ryancdickson/staging/pull/8" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/ryancdickson/staging/pull/8</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[12] </span><a href="https://github.com/cabforum/servercert/pull/487" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/cabforum/servercert/pull/487</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[13] </span><a href="https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5</span></a><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[14] </span><a href="https://github.com/cabforum/servercert/pull/507" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/cabforum/servercert/pull/507</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[15] </span><a href="https://github.com/cabforum/servercert/compare/5224983ef0a6f94c18808ea3469e7a5ae35746e5..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/cabforum/servercert/compare/5224983ef0a6f94c18808ea3469e7a5ae35746e5..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">The following motion has been proposed by Chris Clements and Ryan Dickson of Google (Chrome Root Program) and endorsed by Aaron Gable (ISRG / Let’s Encrypt) and Wayne Thayer (Fastly). </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><b><span style="font-family:Arial,sans-serif;color:black">— Motion Begins —</span></b><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:black">This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates” (“Baseline Requirements”), based on Version 2.0.4.</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:black">MODIFY the Baseline Requirements as specified in the following Redline:</span><u></u><u></u></p><p style="margin:0cm"><a href="https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463</span></a><span style="font-family:Arial,sans-serif;color:black"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><b><span style="font-family:Arial,sans-serif;color:black">— Motion Ends —</span></b><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:black">This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><b><span style="font-family:Arial,sans-serif;color:black">Discussion (at least 11 days)</span></b><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:black">- Start: 2024-05-20 14:30:00 UTC</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:black">- End no earlier than: 2024-05-31 14:30:00 UTC</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0cm"><b><span style="font-family:Arial,sans-serif;color:black">Vote for approval (7 days)</span></b><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:black">- Start: TBD</span><u></u><u></u></p><p style="margin:0cm"><span style="font-family:Arial,sans-serif;color:black">- End: TBD</span><u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p></div></div></div>_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><br>
</div></blockquote></div>