<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Hi Roman,<div><br></div><div>I think it’s because these developments are at an early stage (amongst other reasons) that it doesn’t make sense to postpone the ballot. I don’t see anything super concrete indicating that this project will alter the industry’s approach to MPIC adoption, and I believe something pretty substantive would be necessary in order for it to make sense to adopt this external project as a dependency for updating policy requirements in the TBRs.</div><div><br></div><div>Cheers,</div><div>-Clint<br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Jun 4, 2024, at 12:47 AM, Roman Fischer via Servercert-wg <servercert-wg@cabforum.org> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;">Dear all,<o:p></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><span style="font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;">I was informed by direct mail about the following which I find very interesting and wanted to share here:<o:p></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><span lang="EN-US">Princeton researchers are working on an open source implementation of MPIC and are looking for collaborators: </span><a href="https://freedom-to-tinker.com/2024/02/13/announcing-the-open-multi-perspective-issuance-corroboration-project/" style="color: blue; text-decoration: underline;"><span lang="EN-US">https://freedom-to-tinker.com/2024/02/13/announcing-the-open-multi-perspective-issuance-corroboration-project/</span></a><span lang="EN-US">. The first version of the API specification is on<span class="Apple-converted-space"> </span></span><a href="https://github.com/open-mpic/open-mpic-specification/tree/main" style="color: blue; text-decoration: underline;"><span lang="EN-US">github</span></a><span lang="EN-US">.<o:p></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;">As these developments seem to be in an early stage, wouldn’t it make sense to postpone this ballot until at least a first draft of this open source implementation is available? I don’t think it makes sense that each CA invents their own protocols and possibly makes avoidable mistakes coding / implementing this non-trivial topic..<o:p></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;">Kind regards<br>Roman<o:p></o:p></span></div><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></span></div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor; border-image: none; padding: 3pt 0cm 0cm;"><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;">From:</span></b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;"><span class="Apple-converted-space"> </span>Servercert-wg <<a href="mailto:servercert-wg-bounces@cabforum.org" style="color: blue; text-decoration: underline;">servercert-wg-bounces@cabforum.org</a>><span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Chris Clements via Servercert-wg<br><b>Sent:</b><span class="Apple-converted-space"> </span>Montag, 20. Mai 2024 16:30<br><b>To:</b><span class="Apple-converted-space"> </span>CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org" style="color: blue; text-decoration: underline;">servercert-wg@cabforum.org</a>><br><b>Subject:</b><span class="Apple-converted-space"> </span>[Servercert-wg] Discussion Period Begins - Ballot SC-067 V3: "Require domain validation and CAA checks to be performed from multiple Network Perspectives"<o:p></o:p></span></div></div><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div><div><div style="margin: 0cm;"><b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">Purpose of Ballot SC-067 V3</span></b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">:</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">This Ballot proposes updates to the<span class="Apple-converted-space"> </span><i>Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates</i><span class="Apple-converted-space"> </span>(i.e., TLS BRs) related to “Multi-Perspective Issuance Corroboration” (“MPIC”).</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">Background</span></b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">:</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- MPIC refers to performing domain validation and CAA checks from multiple Network Perspectives before certificate issuance, as described within the Ballot for the applicable validation methods in TLS BR Sections 3.2.2.4 and 3.2.2.5.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- Not all methods described in TLS BR Sections 3.2.2.4 and 3.2.2.5 will require using MPIC.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- This work was most recently motivated by research presented at Face-to-Face 58 [1] by Princeton University, but has been discussed for years prior as well.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- The goal of this proposal is to make it more difficult for adversaries to successfully launch equally-specific prefix attacks against the domain validation processes described in the TLS BRs.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- Additional background information can be found in an update shared at Face-to-Face 60 [2].</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">Benefits of Adoption</span></b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">:</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- Recent publicly-documented attacks have used BGP hijacks to fool domain control validation and obtain malicious certificates, which led to the impersonation of HTTPS websites [3][</span><span style="font-family: Arial, sans-serif;">4</span><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">].</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- Routing security defenses (e.g., RPKI) can mitigate the risk of global BGP attacks, but localized, equally-specific BGP attacks still pose a significant threat to the Web PKI [5][6].</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- Corroborating domain control validation checks from multiple network perspectives (i.e., MPIC) spread across the Internet substantially reduces the threat posed by equally-specific BGP attacks, ensuring the integrity of domain validation and issuance decisions [5][7][8].</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- Existing deployments of MPIC at the scale of millions of certificates a day demonstrate the feasibility of this technique at Internet scale [7][9].</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">Intellectual Property (IP) Disclosure</span></b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">:</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- While not a Server Certificate Working Group Member, researchers from Princeton University presented at Face-to-Face 58, provided academic expertise, and highlighted publicly-available peer-reviewed research to support Members in drafting this ballot.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- The Princeton University researchers indicate that they have not filed for any patents relating to their MPIC work and do not plan to do so in the future.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- Princeton University has indicated that it is unable to agree to the CA/Browser Forum IPR agreement because it could encumber inventions invented by researchers not involved in the development of MPIC or with the CA/B Forum.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- Princeton University has instead provided the attached IPR statement. Pursuant to the IPR statement, Princeton University has granted a worldwide royalty free license to the intellectual property in MPIC developed by the researchers and has made representations regarding its lack of knowledge of any other Princeton intellectual property needed to implement MPIC.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- The attached IPR statement has not changed since disclosed in Discussion Round 1.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif;">- For clarity, Princeton University’s IPR statement is NOT intended to replace the Forum’s IPR agreement or allow Princeton to participate in the Forum in any capacity.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif;">- Members seeking legal advice regarding this ballot should consult their own counsel.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">Proposal Revision History</span></b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">:</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- Pre-Ballot Release #1 (work team artifacts and broader Validation Subcommittee collaboration) [10]</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- Pre-Ballot Release #2 [11]</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">Previous versions of this Ballot</span></b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">:</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);">-</span><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"><span class="Apple-converted-space"> </span>Ballot Release #1 [12] (comparing Version 2 to Version 1) [13]. Note, some of the changes represented in the comparison are updates made by other ballots that have since passed (e.g., SC-069).</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">- Ballot Release #2 [14] (comparing Version 3 to Version 2) [15]. Note, some of the changes represented in the comparison are updates made by other ballots that have since passed (e.g., SC-072).</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">References</span></b><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">:</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[1]<span class="Apple-converted-space"> </span></span><a href="https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-vantage-points.pdf" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-vantage-points.pdf</span></a><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[2]<span class="Apple-converted-space"> </span></span><a href="https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=drive_link" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=drive_link</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[3]<span class="Apple-converted-space"> </span></span><a href="https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[4]<span class="Apple-converted-space"> </span></span><a href="https://www.coinbase.com/blog/celer-bridge-incident-analysis" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://www.coinbase.com/blog/celer-bridge-incident-analysis</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[5]<span class="Apple-converted-space"> </span></span><a href="https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[6]<span class="Apple-converted-space"> </span></span><a href="https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[7]<span class="Apple-converted-space"> </span></span><a href="https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[8]<span class="Apple-converted-space"> </span></span><a href="https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[9]<span class="Apple-converted-space"> </span></span><a href="https://security.googleblog.com/2023/05/google-trust-services-acme-api_0503894189.html" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://security.googleblog.com/2023/05/google-trust-services-acme-api_0503894189.html</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[10]<span class="Apple-converted-space"> </span></span><a href="https://github.com/ryancdickson/staging/pull/6" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://github.com/ryancdickson/staging/pull/6</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[11]<span class="Apple-converted-space"> </span></span><a href="https://github.com/ryancdickson/staging/pull/8" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://github.com/ryancdickson/staging/pull/8</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[12]<span class="Apple-converted-space"> </span></span><a href="https://github.com/cabforum/servercert/pull/487" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://github.com/cabforum/servercert/pull/487</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[13]<span class="Apple-converted-space"> </span></span><a href="https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5</span></a><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[14]<span class="Apple-converted-space"> </span></span><a href="https://github.com/cabforum/servercert/pull/507" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://github.com/cabforum/servercert/pull/507</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">[15]<span class="Apple-converted-space"> </span></span><a href="https://github.com/cabforum/servercert/compare/5224983ef0a6f94c18808ea3469e7a5ae35746e5..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://github.com/cabforum/servercert/compare/5224983ef0a6f94c18808ea3469e7a5ae35746e5..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463</span></a><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(14, 16, 26);">The following motion has been proposed by Chris Clements and Ryan Dickson of Google (Chrome Root Program) and endorsed by Aaron Gable (ISRG / Let’s Encrypt) and Wayne Thayer (Fastly). </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><b><span style="font-family: Arial, sans-serif;">— Motion Begins —</span></b><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif;">This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates” (“Baseline Requirements”), based on Version 2.0.4.</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif;">MODIFY the Baseline Requirements as specified in the following Redline:</span><o:p></o:p></div><div style="margin: 0cm;"><a href="https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463" style="color: blue; text-decoration: underline;"><span style="font-family: Arial, sans-serif;">https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463</span></a><span style="font-family: Arial, sans-serif;"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><b><span style="font-family: Arial, sans-serif;">— Motion Ends —</span></b><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif;">This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><b><span style="font-family: Arial, sans-serif;">Discussion (at least 11 days)</span></b><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif;">- Start: 2024-05-20 14:30:00 UTC</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif;">- End no earlier than: 2024-05-31 14:30:00 UTC</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif; color: rgb(80, 0, 80);"> </span><o:p></o:p></div><div style="margin: 0cm;"><b><span style="font-family: Arial, sans-serif;">Vote for approval (7 days)</span></b><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif;">- Start: TBD</span><o:p></o:p></div><div style="margin: 0cm;"><span style="font-family: Arial, sans-serif;">- End: TBD</span><o:p></o:p></div><div style="margin: 0cm; font-size: 12pt; font-family: Aptos, sans-serif;"><o:p> </o:p></div></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Servercert-wg mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="mailto:Servercert-wg@cabforum.org" style="color: blue; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Servercert-wg@cabforum.org</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" style="color: blue; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a></div></blockquote></div><br></div></body></html>