<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Aptos;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:70.85pt 70.85pt 2.0cm 70.85pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:105731765;
mso-list-template-ids:1172759380;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1
{mso-list-id:276257246;
mso-list-template-ids:-431045702;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2
{mso-list-id:329918159;
mso-list-template-ids:-8742444;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3
{mso-list-id:458257976;
mso-list-template-ids:1237612568;}
@list l3:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l3:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l3:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4
{mso-list-id:796412483;
mso-list-template-ids:1560452038;}
@list l4:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l4:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l4:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5
{mso-list-id:852764691;
mso-list-template-ids:813854092;}
@list l5:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l5:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6
{mso-list-id:979460347;
mso-list-template-ids:-1842444898;}
@list l6:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l6:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7
{mso-list-id:1065374177;
mso-list-template-ids:-695150448;}
@list l7:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l7:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8
{mso-list-id:1121150523;
mso-list-template-ids:1424230762;}
@list l8:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l8:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l8:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l9
{mso-list-id:1218081251;
mso-list-template-ids:-954928068;}
@list l9:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l9:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l9:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l9:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l9:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l9:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l9:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l9:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l9:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l10
{mso-list-id:1482693239;
mso-list-template-ids:389947910;}
@list l10:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l10:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l10:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l10:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l10:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l10:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l10:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l10:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l10:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l11
{mso-list-id:1593514973;
mso-list-template-ids:1659669640;}
@list l11:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l11:level2
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:72.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l11:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:108.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l11:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:144.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l11:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:180.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l11:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:216.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l11:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:252.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l11:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:288.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l11:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:324.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="DE" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Dear Chris,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Sorry that I wasn't aware of that previous discussion
</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Segoe UI Emoji",sans-serif">☹</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">. And since it's a MAY, I guess I'm good with how it's formulated right now.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Rgds<br>
Roman<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Chris Clements <cclements@google.com>
<br>
<b>Sent:</b> Montag, 1. Juli 2024 20:39<br>
<b>To:</b> Aaron Gable <aaron@letsencrypt.org>; CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org><br>
<b>Cc:</b> Roman Fischer <roman.fischer@swisssign.com><br>
<b>Subject:</b> Re: [Servercert-wg] Discussion Period Begins - Ballot SC-067 V2: "Require domain validation and CAA checks to be performed from multiple Network Perspectives"<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:black">Hi Roman, Aaron, </span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:black">The existing ballot text was intended to offer flexibility to adopters and was in response to community feedback on earlier drafts of the ballot (e.g.,
</span><a href="https://lists.cabforum.org/pipermail/validation/2023-June/001904.html"><span style="font-family:"Arial",sans-serif">here</span></a><span style="font-family:"Arial",sans-serif;color:black">). </span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:black">While we agree with your perspective re: simplicity, we equally believe CA Owners should be able to evaluate and adopt implementations that work best for them while also achieving
the stated security objectives of the ballot.</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:black">Thanks</span><o:p></o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:black">-Chris</span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, Jun 28, 2024 at 10:34<span style="font-family:"Arial",sans-serif"> </span>AM Aaron Gable via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org">servercert-wg@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<p class="MsoNormal">Let's Encrypt already implements MPIC, including doing CAA checks from all of our perspectives. Obviously our experience is not universal, but we made the decision to treat remote CAA checks the exact same as primary ones: valid for at
most 8 hours. Although this does increase the number of remote CAA checks we perform, it keeps us much more confident in our code and compliance.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">While I understand the motivation behind allowing remote CAA results to be cached for an extended period, I personally don't think that the motivation is strong enough to actually overcome the extra complications that it brings. I would
prefer that all remote results have the same lifetimes as primary validation data.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Aaron<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Fri, Jun 28, 2024, 01:33 Roman Fischer via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Thanks to both Doug and Chris for these examples.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">That makes me wonder: Wouldn't it be simpler (and thus less error-prone) to remove the CAA caching and
just do the CAA check with each domain validation?</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">Rgds<br>
Roman</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Servercert-wg
<<a href="mailto:servercert-wg-bounces@cabforum.org" target="_blank">servercert-wg-bounces@cabforum.org</a>>
<b>On Behalf Of </b>Chris Clements via Servercert-wg<br>
<b>Sent:</b> Donnerstag, 27. Juni 2024 15:36<br>
<b>To:</b> Doug Beattie <<a href="mailto:doug.beattie@globalsign.com" target="_blank">doug.beattie@globalsign.com</a>><br>
<b>Cc:</b> CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>><br>
<b>Subject:</b> Re: [Servercert-wg] Discussion Period Begins - Ballot SC-067 V2: "Require domain validation and CAA checks to be performed from multiple Network Perspectives"</span><o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:black">Hi Doug,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:black">Working through your examples - and adding one additional, below.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:black">Note: these examples strictly assume the to-be-issued certificates only contain the subject dnsName being described (i.e., if
</span><a href="http://www.example.com/" target="_blank"><span style="font-family:"Arial",sans-serif">www.example.com</span></a><span style="font-family:"Arial",sans-serif;color:black"> is the named subject, we do not assume the certificate will also include
a dnsName of <a href="http://example.com/" target="_blank">example.com</a>).</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoNormal" style="color:black;mso-list:l5 level1 lfo1;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif">Day 1: </span></b><span style="font-family:"Arial",sans-serif">CA performs MPIC for
<a href="http://www.example.com/" target="_blank">www.example.com</a> </span><o:p></o:p></li></ul>
<ul style="margin-top:0cm" type="disc">
<ul style="margin-top:0cm" type="circle">
<li class="MsoNormal" style="color:black;mso-list:l3 level2 lfo2;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif">Corroborating DCV</span></b><span style="font-family:"Arial",sans-serif">: This includes observing a domain validation random token from [N] perspectives, as required by quorum expectations.</span><o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l3 level2 lfo2;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif">Corroborating CAA</span></b><span style="font-family:"Arial",sans-serif">: This includes observing permission to issue when checking CAA from [N] perspectives, as required by quorum expectations.</span><o:p></o:p></li></ul>
</ul>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoNormal" style="color:black;mso-list:l11 level1 lfo3;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif">Day 100: </span></b><span style="font-family:"Arial",sans-serif">A certificate request is made for
<b><a href="http://shop.example.com/" target="_blank"><span style="font-weight:normal">shop.example.com</span></a></b> from the same applicant</span><o:p></o:p></li></ul>
<ul style="margin-top:0cm" type="disc">
<ul style="margin-top:0cm" type="circle">
<li class="MsoNormal" style="color:black;mso-list:l10 level2 lfo4;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif">Corroborating DCV</span></b><span style="font-family:"Arial",sans-serif">: This includes observing a domain validation random token from [N] perspectives, as required by quorum expectations.</span><o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l10 level2 lfo4;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif">Corroborating CAA</span></b><span style="font-family:"Arial",sans-serif">: This MAY NOT be skipped given the certificate issued to the customer on Day 1 was for
<a href="http://www.example.com/" target="_blank">www.example.com</a> and <a href="http://shop.example.com/" target="_blank">
shop.example.com</a> is not a subdomain of <a href="http://www.example.com/" target="_blank">
www.example.com</a>. The process must be completed as it is described in the “Day 1" example.</span><o:p></o:p></li></ul>
</ul>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoNormal" style="color:black;mso-list:l0 level1 lfo5;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif;color:#222222">Day 150:<i> </i></span></b><span style="font-family:"Arial",sans-serif">A certificate request is made for
<a href="http://www.x1.example.com/" target="_blank">x1.www.example.com</a> from the same applicant</span><o:p></o:p></li></ul>
<ul style="margin-top:0cm" type="disc">
<ul style="margin-top:0cm" type="circle">
<li class="MsoNormal" style="color:black;mso-list:l1 level2 lfo6;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif">Corroborating DCV</span></b><span style="font-family:"Arial",sans-serif">: This includes observing a domain validation random token from [N] perspectives, as required by quorum expectations.</span><o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l1 level2 lfo6;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif">Corroborating CAA</span></b><span style="font-family:"Arial",sans-serif">: This MAY be skipped given the MPIC CAA event on Day 1 for
<a href="http://www.example.com/" target="_blank">www.example.com</a> and the described 398-day reuse period because
<a href="http://x1.www.example.com/" target="_blank">x1.www.example.com</a> is a subdomain of
<a href="http://www.example.com/" target="_blank">www.example.com</a>.</span><o:p></o:p></li></ul>
</ul>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoNormal" style="color:black;mso-list:l7 level1 lfo7;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif;color:#222222">Day 400: </span></b><span style="font-family:"Arial",sans-serif">A certificate request is made for
<a href="http://www.x1.example.com/" target="_blank">x2.www.example.com</a></span><o:p></o:p></li></ul>
<ul style="margin-top:0cm" type="disc">
<ul style="margin-top:0cm" type="circle">
<li class="MsoNormal" style="color:black;mso-list:l8 level2 lfo8;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif">Corroborating DCV</span></b><span style="font-family:"Arial",sans-serif">: This includes observing a domain validation random token from [N] perspectives, as required by quorum expectations.</span><o:p></o:p></li><li class="MsoNormal" style="color:black;mso-list:l8 level2 lfo8;vertical-align:baseline;font-variant-numeric:normal;font-variant-east-asian:normal;font-variant-alternates:normal;white-space:pre-wrap">
<b><span style="font-family:"Arial",sans-serif">Corroborating CAA</span></b><span style="font-family:"Arial",sans-serif">: Prior reuse cache for
<a href="http://www.example.com/" target="_blank">www.example.com</a> (Day 1) is now expired. The CA must observe permission to issue when checking CAA from [N] perspectives, as required by quorum expectations.</span><o:p></o:p></li></ul>
</ul>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:black">Hopefully this helps clarify, but let us know if you have any questions.</span><o:p></o:p></p>
<p style="margin:0cm"><span style="font-family:"Arial",sans-serif;color:black">-Chris</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><br>
<span style="font-family:"Arial",sans-serif;color:black">P.S., this response has also been copied to the same
</span><a href="https://docs.google.com/document/d/11V43IrkwGbDvL69hxm2smukJfgZH9Qs0md4CPNdbViw/edit" target="_blank"><span style="font-family:"Arial",sans-serif">doc</span></a><span style="font-family:"Arial",sans-serif;color:black"> we referenced in response
to Christophe in case of any formatting issues conveyed through the list.</span><o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">On Tue, Jun 25, 2024 at 2:17<span style="font-family:"Arial",sans-serif"> </span>PM Doug Beattie <<a href="mailto:doug.beattie@globalsign.com" target="_blank">doug.beattie@globalsign.com</a>>
wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0cm;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt">Hi Chris,</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt">I was taking a closer look at the ballot and specifically this section on caching the remote node CAA checks:</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:36.0pt">
<span lang="EN-US">A CA MAY reuse corroborating evidence for CAA record quorum compliance for a maximum of 398 days. After issuing a Certificate to a domain, remote Network Perspectives MAY omit retrieving and processing CAA records for the same domain or its
<strong><span style="font-family:"Aptos",sans-serif">subdomains </span></strong>in subsequent Certificate requests from the same Applicant for up to a maximum of 398 days.</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt">I think understand the first sentence – if you do a full check on a FQDN (the value that you will put into the SAN field), then you only
need to do the normal CAA check for that FQDN from the primary node for 398 days. </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt">I don’t understand the references to domain and subdomains in the second sentence. Can you explain how this should work?</span><o:p></o:p></p>
<ul type="disc">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l6 level1 lfo9">
<span lang="EN-US" style="font-size:11.0pt">You do a full MIC check on <a href="http://www.example.com/" target="_blank">
www.example.com</a> on day 1</span><o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l6 level1 lfo9">
<span lang="EN-US" style="font-size:11.0pt">You find CAA records with permission to issue on
<a href="http://example.com/" target="_blank">example.com</a> on primary and remote nodes so you issue</span><o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l6 level1 lfo9">
<span lang="EN-US" style="font-size:11.0pt">Day 100, customer wants to issue to <a href="http://shop.example.com/" target="_blank">
shop.example.com</a></span><o:p></o:p></li></ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level2 lfo10">
<span lang="EN-US" style="font-size:11.0pt">This is a subdomain of <a href="http://example.com/" target="_blank">
example.com</a> where we found the records permitting issuance on day 1. </span><o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level2 lfo10">
<span lang="EN-US" style="font-size:11.0pt">What checks do we need to do for this request?</span><o:p></o:p></li></ul>
</ul>
<ul type="disc">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l9 level1 lfo11">
<span lang="EN-US" style="font-size:11.0pt">Day 150, Applicant wants to issue to <a href="http://x1.www.example.com/" target="_blank">
x1.www.example.com</a> (a subdomain of <a href="http://www.example.com/" target="_blank">
www.example.com</a> we issued on day 1):</span><o:p></o:p></li></ul>
<ul type="disc">
<ul type="circle">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l4 level2 lfo12">
<span lang="EN-US" style="font-size:11.0pt">What checks would be required here?</span><o:p></o:p></li></ul>
</ul>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt">Maybe I’m reading too much into this…</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt">Thanks!</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt">Doug</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US" style="font-size:11.0pt"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif"> Servercert-wg
<<a href="mailto:servercert-wg-bounces@cabforum.org" target="_blank">servercert-wg-bounces@cabforum.org</a>>
<b>On Behalf Of </b>Chris Clements via Servercert-wg<br>
<b>Sent:</b> Friday, April 26, 2024 1:01 PM<br>
<b>To:</b> CA/B Forum Server Certificate WG Public Discussion List <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>><br>
<b>Subject:</b> [Servercert-wg] Discussion Period Begins - Ballot SC-067 V2: "Require domain validation and CAA checks to be performed from multiple Network Perspectives"</span><o:p></o:p></p>
</div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> </span><o:p></o:p></p>
<div>
<p style="margin:0cm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Purpose of Ballot SC-067 V2</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">This Ballot proposes updates to the
<i>Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates</i> (i.e., TLS BRs) related to “Multi-Perspective Issuance Corroboration” (“MPIC”).</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Background</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- MPIC refers to performing domain validation and CAA checks from multiple Network Perspectives before certificate issuance, as described within the Ballot for the
applicable validation methods in TLS BR Sections 3.2.2.4 and 3.2.2.5.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Not all methods described in TLS BR Sections 3.2.2.4 and 3.2.2.5 will require using MPIC.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- This work was most recently motivated by research presented at Face-to-Face 58 [1] by Princeton University, but has been discussed for years prior as well.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- The goal of this proposal is to make it more difficult for adversaries to successfully launch equally-specific prefix attacks against the domain validation processes
described in the TLS BRs.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Additional background information can be found in an update shared at Face-to-Face 60 [2].</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Benefits of Adoption</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Recent publicly-documented attacks have used BGP hijacks to fool domain control validation and obtain malicious certificates, which led to the impersonation of HTTPS
websites [3][</span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">4</span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">].</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Routing security defenses (e.g., RPKI) can mitigate the risk of global BGP attacks, but localized, equally-specific BGP attacks still pose a significant threat to
the Web PKI [5][6].</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Corroborating domain control validation checks from multiple network perspectives (i.e., MPIC) spread across the Internet substantially reduces the threat posed
by equally-specific BGP attacks, ensuring the integrity of domain validation and issuance decisions [5][7][8].</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Existing deployments of MPIC at the scale of millions of certificates a day demonstrate the feasibility of this technique at Internet scale [7][9].</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Intellectual Property (IP) Disclosure</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- While not a Server Certificate Working Group Member, researchers from Princeton University presented at Face-to-Face 58, provided academic expertise, and highlighted
publicly-available peer-reviewed research to support Members in drafting this ballot.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- The Princeton University researchers indicate that they have not filed for any patents relating to their MPIC work and do not plan to do so in the future.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Princeton University has indicated that it is unable to agree to the CA/Browser Forum IPR agreement because it could encumber inventions invented by researchers
not involved in the development of MPIC or with the CA/B Forum.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Princeton University has instead provided the attached IPR statement. Pursuant to the IPR statement, Princeton University has granted a worldwide royalty free license
to the intellectual property in MPIC developed by the researchers and has made representations regarding its lack of knowledge of any other Princeton intellectual property needed to implement MPIC.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- The attached IPR statement has not changed since disclosed in Discussion Round 1.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- For clarity, Princeton University’s IPR statement is NOT intended to replace the Forum’s IPR agreement or allow Princeton to participate in the Forum in any capacity.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- Members seeking legal advice regarding this ballot should consult their own counsel.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Proposal Revision History</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Pre-Ballot Release #1 (work team artifacts and broader Validation Subcommittee collaboration) [10]</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Pre-Ballot Release #2 [11]</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Previous versions of this Ballot</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> -</span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> Ballot Release #1 [12] (comparing Version 2 to Version 1) [13]. Note, some of the
changes represented in the comparison are updates made by other ballots that have since passed (e.g., SC-069).</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">References</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[1]
</span><span lang="EN-US"><a href="https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-vantage-points.pdf" target="_blank"><span style="font-family:"Arial",sans-serif">https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-vantage-points.pdf</span></a></span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[2]
</span><span lang="EN-US"><a href="https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=drive_link" target="_blank"><span style="font-family:"Arial",sans-serif">https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=drive_link</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[3]
</span><span lang="EN-US"><a href="https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600" target="_blank"><span style="font-family:"Arial",sans-serif">https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[4]
</span><span lang="EN-US"><a href="https://www.coinbase.com/blog/celer-bridge-incident-analysis" target="_blank"><span style="font-family:"Arial",sans-serif">https://www.coinbase.com/blog/celer-bridge-incident-analysis</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[5]
</span><span lang="EN-US"><a href="https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski" target="_blank"><span style="font-family:"Arial",sans-serif">https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[6]
</span><span lang="EN-US"><a href="https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf" target="_blank"><span style="font-family:"Arial",sans-serif">https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[7]
</span><span lang="EN-US"><a href="https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee" target="_blank"><span style="font-family:"Arial",sans-serif">https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[8]
</span><span lang="EN-US"><a href="https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee" target="_blank"><span style="font-family:"Arial",sans-serif">https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[9]
</span><span lang="EN-US"><a href="https://security.googleblog.com/2023/05/google-trust-services-acme-api_0503894189.html" target="_blank"><span style="font-family:"Arial",sans-serif">https://security.googleblog.com/2023/05/google-trust-services-acme-api_0503894189.html</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[10]
</span><span lang="EN-US"><a href="https://github.com/ryancdickson/staging/pull/6" target="_blank"><span style="font-family:"Arial",sans-serif">https://github.com/ryancdickson/staging/pull/6</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[11]
</span><span lang="EN-US"><a href="https://github.com/ryancdickson/staging/pull/8" target="_blank"><span style="font-family:"Arial",sans-serif">https://github.com/ryancdickson/staging/pull/8</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[12]
</span><span lang="EN-US"><a href="https://github.com/cabforum/servercert/pull/487" target="_blank"><span style="font-family:"Arial",sans-serif">https://github.com/cabforum/servercert/pull/487</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[13]
</span><span lang="EN-US"><a href="https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5" target="_blank"><span style="font-family:"Arial",sans-serif">https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5</span></a></span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">The following motion has been proposed by Chris Clements and Ryan Dickson of Google (Chrome Root Program) and endorsed by Aaron Gable (ISRG / Let’s Encrypt) and Wayne
Thayer (Fastly). </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">— Motion Begins —</span></b><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">This ballot modifies the “Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates” (“Baseline Requirements”), based on Version
2.0.4.</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">MODIFY the Baseline Requirements as specified in the following Redline:</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US"><a href="https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..5224983ef0a6f94c18808ea3469e7a5ae35746e5" target="_blank"><span style="font-family:"Arial",sans-serif">https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..5224983ef0a6f94c18808ea3469e7a5ae35746e5</span></a></span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">— Motion Ends —</span></b><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">Discussion (at least 14 days)</span></b><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- Start: 2024-04-26 17:00:00 UTC</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- End no earlier than: 2024-05-10 17:00:00 UTC</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050"> </span><o:p></o:p></p>
<p style="margin:0cm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">Vote for approval (7 days)</span></b><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- Start: TBD</span><o:p></o:p></p>
<p style="margin:0cm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- End: TBD</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span lang="EN-US"> </span><o:p></o:p></p>
</div>
</div>
</div>
</div>
</blockquote>
</div>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal">_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>