<div dir="ltr"><span id="m_8758538219075998911gmail-docs-internal-guid-6103e093-7fff-cc53-63d6-353d18cd8303"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Hi Doug,</span></p><br><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Working through your examples - and adding one additional, below.</span></p><br><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Note: these examples strictly assume the to-be-issued certificates only contain the subject dnsName being described (i.e., if </span><a href="http://www.example.com" style="text-decoration-line:none" target="_blank"><span style="font-family:Arial,sans-serif;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">www.example.com</span></a><span style="font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> is the named subject, we </span><span style="font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">do not</span><span style="font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> assume the certificate will also include a dnsName of <a href="http://example.com" target="_blank">example.com</a>).</span></p><br><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Day 1: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">CA performs MPIC for </span><a href="http://www.example.com" style="text-decoration-line:none" target="_blank"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">www.example.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> </span></p></li><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:circle;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Corroborating DCV</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">: This includes observing a domain validation random token from [N] perspectives, as required by quorum expectations.</span></p></li><li dir="ltr" style="list-style-type:circle;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Corroborating CAA</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">: This includes observing permission to issue when checking CAA from [N] perspectives, as required by quorum expectations.</span></p></li></ul></ul><br><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Day 100: </span><span style="background-color:transparent;font-weight:400;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">A certificate request is made for </span><a href="http://shop.example.com/" style="text-decoration-line:none" target="_blank"><span style="background-color:transparent;font-weight:400;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">shop.example.com</span></a><span style="background-color:transparent;font-weight:400;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> from the same applicant</span></p></li><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:circle;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Corroborating DCV</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">: This includes observing a domain validation random token from [N] perspectives, as required by quorum expectations.</span></p></li><li dir="ltr" style="list-style-type:circle;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Corroborating CAA</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">: This MAY NOT be skipped given the certificate issued to the customer on Day 1 was for </span><a href="http://www.example.com" style="text-decoration-line:none" target="_blank"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">www.example.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> and </span><a href="http://shop.example.com" style="text-decoration-line:none" target="_blank"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">shop.example.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> is not a subdomain of </span><a href="http://www.example.com" style="text-decoration-line:none" target="_blank"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">www.example.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">. The process must be completed as it is described in the “Day 1" example.</span></p></li></ul></ul><br><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Day 150:</span><span style="color:rgb(34,34,34);background-color:transparent;font-weight:700;font-style:italic;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">A certificate request is made for </span><a href="http://www.x1.example.com" style="text-decoration-line:none" target="_blank"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">x1.www.example.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> from the same applicant</span></p></li><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:circle;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Corroborating DCV</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">: This includes observing a domain validation random token from [N] perspectives, as required by quorum expectations.</span></p></li><li dir="ltr" style="list-style-type:circle;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Corroborating CAA</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">: This MAY be skipped given the MPIC CAA event on Day 1 for </span><a href="http://www.example.com" style="text-decoration-line:none" target="_blank"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">www.example.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> and the described 398-day reuse period because </span><a href="http://x1.www.example.com" style="text-decoration-line:none" target="_blank"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">x1.www.example.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> is a subdomain of </span><a href="http://www.example.com" style="text-decoration-line:none" target="_blank"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">www.example.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">.</span></p></li></ul></ul><br><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:disc;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="color:rgb(34,34,34);background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Day 400: </span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">A certificate request is made for </span><a href="http://www.x1.example.com" style="text-decoration-line:none" target="_blank"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">x2.www.example.com</span></a></p></li><ul style="margin-top:0px;margin-bottom:0px"><li dir="ltr" style="list-style-type:circle;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Corroborating DCV</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">: This includes observing a domain validation random token from [N] perspectives, as required by quorum expectations.</span></p></li><li dir="ltr" style="list-style-type:circle;font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline;white-space:pre-wrap"><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt" role="presentation"><span style="background-color:transparent;font-weight:700;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Corroborating CAA</span><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">: Prior reuse cache for </span><a href="http://www.example.com" style="text-decoration-line:none" target="_blank"><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">www.example.com</span></a><span style="background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> (Day 1) is now expired. The CA must observe permission to issue when checking CAA from [N] perspectives, as required by quorum expectations.</span></p></li></ul></ul><br><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">Hopefully this helps clarify, but let us know if you have any questions.</span></p><p dir="ltr" style="line-height:1.38;margin-top:0pt;margin-bottom:0pt"><span style="font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">-Chris</span></p><br><span style="font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline">P.S., this response has also been copied to the same </span><a href="https://docs.google.com/document/d/11V43IrkwGbDvL69hxm2smukJfgZH9Qs0md4CPNdbViw/edit" style="text-decoration-line:none" target="_blank"><span style="font-family:Arial,sans-serif;background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;text-decoration-line:underline;vertical-align:baseline">doc</span></a><span style="font-family:Arial,sans-serif;color:rgb(0,0,0);background-color:transparent;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;vertical-align:baseline"> we referenced in response to Christophe in case of any formatting issues conveyed through the list.</span></span><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Jun 25, 2024 at 2:17 PM Doug Beattie <<a href="mailto:doug.beattie@globalsign.com" target="_blank">doug.beattie@globalsign.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div><div lang="EN-US"><div><p class="MsoNormal"><span style="font-size:11pt">Hi Chris,<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">I was taking a closer look at the ballot and specifically this section on caching the remote node CAA checks:<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><p class="MsoNormal" style="margin-left:0.5in"><span>A CA MAY reuse corroborating evidence for CAA record quorum compliance for a maximum of 398 days. After issuing a Certificate to a domain, remote Network Perspectives MAY omit retrieving and processing CAA records for the same domain or its </span><strong><span style="font-family:Aptos,sans-serif">subdomains </span></strong><span>in subsequent Certificate requests from the same Applicant for up to a maximum of 398 days.</span><span style="font-size:11pt"><u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">I think understand the first sentence – if you do a full check on a FQDN (the value that you will put into the SAN field), then you only need to do the normal CAA check for that FQDN from the primary node for 398 days.  <u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">I don’t understand the references to domain and subdomains in the second sentence.  Can you explain how this should work?<u></u><u></u></span></p><ul style="margin-top:0in" type="disc"><li style="margin-left:0in"><span style="font-size:11pt">You do a full MIC  check on <a href="http://www.example.com" target="_blank">www.example.com</a> on day 1<u></u><u></u></span></li><li style="margin-left:0in"><span style="font-size:11pt">You find CAA records with permission to issue on <a href="http://example.com" target="_blank">example.com</a> on primary and remote nodes so you issue<u></u><u></u></span></li><li style="margin-left:0in"><span style="font-size:11pt">Day 100, customer wants to issue to <a href="http://shop.example.com" target="_blank">shop.example.com</a><u></u><u></u></span></li><ul style="margin-top:0in" type="circle"><li style="margin-left:0in"><span style="font-size:11pt">This is a subdomain of <a href="http://example.com" target="_blank">example.com</a> where we found the records permitting issuance on day 1. <u></u><u></u></span></li><li style="margin-left:0in"><span style="font-size:11pt">What checks do we need to do for this request?<u></u><u></u></span></li></ul><li style="margin-left:0in"><span style="font-size:11pt">Day 150, Applicant wants to issue to <a href="http://x1.www.example.com" target="_blank">x1.www.example.com</a> (a subdomain of <a href="http://www.example.com" target="_blank">www.example.com</a> we issued on day 1):<u></u><u></u></span></li><ul style="margin-top:0in" type="circle"><li style="margin-left:0in"><span style="font-size:11pt">What checks would be required here?<u></u><u></u></span></li></ul></ul><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">Maybe I’m reading too much into this…<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">Thanks!<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><p class="MsoNormal"><span style="font-size:11pt">Doug<u></u><u></u></span></p><p class="MsoNormal"><span style="font-size:11pt"><u></u> <u></u></span></p><div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in"><p class="MsoNormal"><b><span style="font-size:11pt;font-family:Calibri,sans-serif">From:</span></b><span style="font-size:11pt;font-family:Calibri,sans-serif"> Servercert-wg <<a href="mailto:servercert-wg-bounces@cabforum.org" target="_blank">servercert-wg-bounces@cabforum.org</a>> <b>On Behalf Of </b>Chris Clements via Servercert-wg<br><b>Sent:</b> Friday, April 26, 2024 1:01 PM<br><b>To:</b> CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>><br><b>Subject:</b> [Servercert-wg] Discussion Period Begins - Ballot SC-067 V2: "Require domain validation and CAA checks to be performed from multiple Network Perspectives"<u></u><u></u></span></p></div><p class="MsoNormal"><u></u> <u></u></p><div><p style="margin:0in"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Purpose of Ballot SC-067 V2</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">This Ballot proposes updates to the <i>Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates</i> (i.e., TLS BRs) related to “Multi-Perspective Issuance Corroboration” (“MPIC”).</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Background</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- MPIC refers to performing domain validation and CAA checks from multiple Network Perspectives before certificate issuance, as described within the Ballot for the applicable validation methods in TLS BR Sections 3.2.2.4 and 3.2.2.5.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Not all methods described in TLS BR Sections 3.2.2.4 and 3.2.2.5 will require using MPIC.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- This work was most recently motivated by research presented at Face-to-Face 58 [1] by Princeton University, but has been discussed for years prior as well.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- The goal of this proposal is to make it more difficult for adversaries to successfully launch equally-specific prefix attacks against the domain validation processes described in the TLS BRs.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Additional background information can be found in an update shared at Face-to-Face 60 [2].</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Benefits of Adoption</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Recent publicly-documented attacks have used BGP hijacks to fool domain control validation and obtain malicious certificates, which led to the impersonation of HTTPS websites [3][</span><span style="font-family:Arial,sans-serif;color:black">4</span><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">].</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Routing security defenses (e.g., RPKI) can mitigate the risk of global BGP attacks, but localized, equally-specific BGP attacks still pose a significant threat to the Web PKI [5][6].</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Corroborating domain control validation checks from multiple network perspectives (i.e., MPIC) spread across the Internet substantially reduces the threat posed by equally-specific BGP attacks, ensuring the integrity of domain validation and issuance decisions [5][7][8].</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Existing deployments of MPIC at the scale of millions of certificates a day demonstrate the feasibility of this technique at Internet scale [7][9].</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Intellectual Property (IP) Disclosure</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- While not a Server Certificate Working Group Member, researchers from Princeton University presented at Face-to-Face 58, provided academic expertise, and highlighted publicly-available peer-reviewed research to support Members in drafting this ballot.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- The Princeton University researchers indicate that they have not filed for any patents relating to their MPIC work and do not plan to do so in the future.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Princeton University has indicated that it is unable to agree to the CA/Browser Forum IPR agreement because it could encumber inventions invented by researchers not involved in the development of MPIC or with the CA/B Forum.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Princeton University has instead provided the attached IPR statement. Pursuant to the IPR statement, Princeton University has granted a worldwide royalty free license to the intellectual property in MPIC developed by the researchers and has made representations regarding its lack of knowledge of any other Princeton intellectual property needed to implement MPIC.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- The attached IPR statement has not changed since disclosed in Discussion Round 1.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:black">- For clarity, Princeton University’s IPR statement is NOT intended to replace the Forum’s IPR agreement or allow Princeton to participate in the Forum in any capacity.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:black">- Members seeking legal advice regarding this ballot should consult their own counsel.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Proposal Revision History</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Pre-Ballot Release #1 (work team artifacts and broader Validation Subcommittee collaboration) [10]</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">- Pre-Ballot Release #2 [11]</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">Previous versions of this Ballot</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> -</span><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> Ballot Release #1 [12] (comparing Version 2 to Version 1) [13]. Note, some of the changes represented in the comparison are updates made by other ballots that have since passed (e.g., SC-069).</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">References</span></b><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">:</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[1] </span><a href="https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-vantage-points.pdf" target="_blank"><span style="font-family:Arial,sans-serif">https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-vantage-points.pdf</span></a><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[2] </span><a href="https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=drive_link" target="_blank"><span style="font-family:Arial,sans-serif">https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=drive_link</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[3] </span><a href="https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600" target="_blank"><span style="font-family:Arial,sans-serif">https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[4] </span><a href="https://www.coinbase.com/blog/celer-bridge-incident-analysis" target="_blank"><span style="font-family:Arial,sans-serif">https://www.coinbase.com/blog/celer-bridge-incident-analysis</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[5] </span><a href="https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski" target="_blank"><span style="font-family:Arial,sans-serif">https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">  </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[6] </span><a href="https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf" target="_blank"><span style="font-family:Arial,sans-serif">https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[7] </span><a href="https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee" target="_blank"><span style="font-family:Arial,sans-serif">https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[8] </span><a href="https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee" target="_blank"><span style="font-family:Arial,sans-serif">https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[9] </span><a href="https://security.googleblog.com/2023/05/google-trust-services-acme-api_0503894189.html" target="_blank"><span style="font-family:Arial,sans-serif">https://security.googleblog.com/2023/05/google-trust-services-acme-api_0503894189.html</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[10] </span><a href="https://github.com/ryancdickson/staging/pull/6" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/ryancdickson/staging/pull/6</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[11] </span><a href="https://github.com/ryancdickson/staging/pull/8" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/ryancdickson/staging/pull/8</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[12] </span><a href="https://github.com/cabforum/servercert/pull/487" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/cabforum/servercert/pull/487</span></a><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">[13] </span><a href="https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5</span></a><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(14,16,26)">The following motion has been proposed by Chris Clements and Ryan Dickson of Google (Chrome Root Program) and endorsed by Aaron Gable (ISRG / Let’s Encrypt) and Wayne Thayer (Fastly). </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><b><span style="font-family:Arial,sans-serif;color:black">— Motion Begins —</span></b><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:black">This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates” (“Baseline Requirements”), based on Version 2.0.4.</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:black">MODIFY the Baseline Requirements as specified in the following Redline:</span><u></u><u></u></p><p style="margin:0in"><a href="https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..5224983ef0a6f94c18808ea3469e7a5ae35746e5" target="_blank"><span style="font-family:Arial,sans-serif">https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..5224983ef0a6f94c18808ea3469e7a5ae35746e5</span></a><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><b><span style="font-family:Arial,sans-serif;color:black">— Motion Ends —</span></b><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:black">This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><b><span style="font-family:Arial,sans-serif;color:black">Discussion (at least 14 days)</span></b><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:black">- Start: 2024-04-26 17:00:00 UTC</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:black">- End no earlier than: 2024-05-10 17:00:00 UTC</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:rgb(80,0,80)"> </span><u></u><u></u></p><p style="margin:0in"><b><span style="font-family:Arial,sans-serif;color:black">Vote for approval (7 days)</span></b><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:black">- Start: TBD</span><u></u><u></u></p><p style="margin:0in"><span style="font-family:Arial,sans-serif;color:black">- End: TBD</span><u></u><u></u></p><p class="MsoNormal"><u></u> <u></u></p></div></div></div></div></blockquote></div>