<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:dt="uuid:C2F41010-65B3-11d1-A29F-00AA00C14882" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Batang;
panose-1:2 3 6 0 0 1 1 1 1 1;}
@font-face
{font-family:PMingLiU;
panose-1:2 1 6 1 0 1 1 1 1 1;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:游ゴシック;
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"ＭＳ Ｐゴシック";
panose-1:2 11 6 0 7 2 5 8 2 4;}
@font-face
{font-family:"\@ＭＳ Ｐゴシック";}
@font-face
{font-family:"\@游ゴシック";
panose-1:2 11 4 0 0 0 0 0 0 0;}
@font-face
{font-family:"\@Batang";
panose-1:2 3 6 0 0 1 1 1 1 1;}
@font-face
{font-family:"\@PMingLiU";
panose-1:2 1 6 1 0 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0mm;
font-size:12.0pt;
font-family:"PMingLiU",serif;
mso-fareast-language:ZH-TW;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.24
{mso-style-type:personal-compose;
font-family:游ゴシック;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:99.25pt 30.0mm 30.0mm 30.0mm;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026">
<v:textbox inset="5.85pt,.7pt,5.85pt,.7pt" />
</o:shapedefaults></xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="JA" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:JA">SECOM Trust Systems votes YES on Ballot SC-067 V3.<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:JA"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:JA">Best Regards,</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:JA"><o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-fareast-language:JA"><o:p> </o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-fareast-language:JA">ONO, Fumiaki<o:p></o:p></span></p>
<p class="MsoNormal" style="text-align:justify"><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:black;mso-fareast-language:JA">SECOM Trust Systems Co., Ltd.</span><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:JA"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:11.0pt;font-family:游ゴシック;mso-fareast-language:JA"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0mm 0mm 0mm">
<p class="MsoNormal"><b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:JA">From:</span></b><span lang="EN-US" style="font-size:11.0pt;font-family:"Calibri",sans-serif;mso-fareast-language:JA"> Servercert-wg
<servercert-wg-bounces@cabforum.org> <b>On Behalf Of </b>Chris Clements via Servercert-wg<br>
<b>Sent:</b> Tuesday, July 16, 2024 12:30 AM<br>
<b>To:</b> CA/B Forum Server Certificate WG Public Discussion List <servercert-wg@cabforum.org><br>
<b>Subject:</b> [Servercert-wg] Voting Period Begins - Ballot SC-067 V3: "Require domain validation and CAA checks to be performed from multiple Network Perspectives"<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<div>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Purpose of Ballot SC-067 V3</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><span lang="EN-US"><o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">This Ballot proposes updates to the
<i>Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates</i> (i.e., TLS BRs) related to ulti-Perspective Issuance Corroboration?(PIC?.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Background</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- MPIC refers to performing domain validation and CAA checks from multiple Network Perspectives before certificate issuance, as described within the Ballot for the
applicable validation methods in TLS BR Sections 3.2.2.4 and 3.2.2.5.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Not all methods described in TLS BR Sections 3.2.2.4 and 3.2.2.5 will require using MPIC.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- This work was most recently motivated by research presented at Face-to-Face 58 [1] by Princeton University, but has been discussed for years prior as well.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- The goal of this proposal is to make it more difficult for adversaries to successfully launch equally-specific prefix attacks against the domain validation processes
described in the TLS BRs.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Additional background information can be found in an update shared at Face-to-Face 60 [2].</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Benefits of Adoption</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Recent publicly-documented attacks have used BGP hijacks to fool domain control validation and obtain malicious certificates, which led to the impersonation of HTTPS
websites [3][</span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">4</span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">].</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Routing security defenses (e.g., RPKI) can mitigate the risk of global BGP attacks, but localized, equally-specific BGP attacks still pose a significant threat to
the Web PKI [5][6].</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Corroborating domain control validation checks from multiple network perspectives (i.e., MPIC) spread across the Internet substantially reduces the threat posed
by equally-specific BGP attacks, ensuring the integrity of domain validation and issuance decisions [5][7][8].</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Existing deployments of MPIC at the scale of millions of certificates a day demonstrate the feasibility of this technique at Internet scale [7][9].</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Intellectual Property (IP) Disclosure</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- While not a Server Certificate Working Group Member, researchers from Princeton University presented at Face-to-Face 58, provided academic expertise, and highlighted
publicly-available peer-reviewed research to support Members in drafting this ballot.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- The Princeton University researchers indicate that they have not filed for any patents relating to their MPIC work and do not plan to do so in the future.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Princeton University has indicated that it is unable to agree to the CA/Browser Forum IPR agreement because it could encumber inventions invented by researchers
not involved in the development of MPIC or with the CA/B Forum.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Princeton University has instead provided the attached IPR statement. Pursuant to the IPR statement, Princeton University has granted a worldwide royalty free license
to the intellectual property in MPIC developed by the researchers and has made representations regarding its lack of knowledge of any other Princeton intellectual property needed to implement MPIC.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- The attached IPR statement has not changed since disclosed in Discussion Round 1.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- For clarity, Princeton University IPR statement is NOT intended to replace the Forum IPR agreement or allow Princeton to participate in the Forum in any capacity.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- Members seeking legal advice regarding this ballot should consult their own counsel.</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Proposal Revision History</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Pre-Ballot Release #1 (work team artifacts and broader Validation Subcommittee collaboration) [10]</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Pre-Ballot Release #2 [11]</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">Previous versions of this Ballot</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#500050">-</span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> Ballot Release #1 [12] (comparing Version 2 to Version 1) [13]. Note, some of the
changes represented in the comparison are updates made by other ballots that have since passed (e.g., SC-069).</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">- Ballot Release #2 [14] (comparing Version 3 to Version 2) [15]. Note, some of the changes represented in the comparison are updates made by other ballots that have
since passed (e.g., SC-072).</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">References</span></b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">:</span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[1]
</span><span lang="EN-US"><a href="https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-vantage-points.pdf"><span style="font-family:"Arial",sans-serif">https://cabforum.org/wp-content/uploads/13-CAB-Forum-face-to-face-multiple-vantage-points.pdf</span></a><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[2]
</span><span lang="EN-US"><a href="https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=drive_link"><span style="font-family:"Arial",sans-serif">https://drive.google.com/file/d/1LTwtAwHXcSaPVSsqKQztNJrV2ozHJ7ZL/view?usp=drive_link</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[3]
</span><span lang="EN-US"><a href="https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600"><span style="font-family:"Arial",sans-serif">https://medium.com/s2wblog/post-mortem-of-klayswap-incident-through-bgp-hijacking-en-3ed7e33de600</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[4]
</span><span lang="EN-US"><a href="https://www.coinbase.com/blog/celer-bridge-incident-analysis"><span style="font-family:"Arial",sans-serif">https://www.coinbase.com/blog/celer-bridge-incident-analysis</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[5]
</span><span lang="EN-US"><a href="https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski"><span style="font-family:"Arial",sans-serif">https://www.usenix.org/conference/usenixsecurity23/presentation/cimaszewski</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[6]
</span><span lang="EN-US"><a href="https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf"><span style="font-family:"Arial",sans-serif">https://www.blackhat.com/docs/us-15/materials/us-15-Gavrichenkov-Breaking-HTTPS-With-BGP-Hijacking-wp.pdf</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[7]
</span><span lang="EN-US"><a href="https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee"><span style="font-family:"Arial",sans-serif">https://www.usenix.org/conference/usenixsecurity21/presentation/birge-lee</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[8]
</span><span lang="EN-US"><a href="https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee"><span style="font-family:"Arial",sans-serif">https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[9]
</span><span lang="EN-US"><a href="https://security.googleblog.com/2023/05/google-trust-services-acme-api_0503894189.html"><span style="font-family:"Arial",sans-serif">https://security.googleblog.com/2023/05/google-trust-services-acme-api_0503894189.html</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[10]
</span><span lang="EN-US"><a href="https://github.com/ryancdickson/staging/pull/6"><span style="font-family:"Arial",sans-serif">https://github.com/ryancdickson/staging/pull/6</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[11]
</span><span lang="EN-US"><a href="https://github.com/ryancdickson/staging/pull/8"><span style="font-family:"Arial",sans-serif">https://github.com/ryancdickson/staging/pull/8</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[12]
</span><span lang="EN-US"><a href="https://github.com/cabforum/servercert/pull/487"><span style="font-family:"Arial",sans-serif">https://github.com/cabforum/servercert/pull/487</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[13]
</span><span lang="EN-US"><a href="https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5"><span style="font-family:"Arial",sans-serif">https://github.com/cabforum/servercert/compare/6d10abda8980c6eb941987d3fc26e753e62858c0..5224983ef0a6f94c18808ea3469e7a5ae35746e5</span></a><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[14]
</span><span lang="EN-US"><a href="https://github.com/cabforum/servercert/pull/507"><span style="font-family:"Arial",sans-serif">https://github.com/cabforum/servercert/pull/507</span></a></span><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A"> </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">[15]
</span><span lang="EN-US"><a href="https://github.com/cabforum/servercert/compare/5224983ef0a6f94c18808ea3469e7a5ae35746e5..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463"><span style="font-family:"Arial",sans-serif">https://github.com/cabforum/servercert/compare/5224983ef0a6f94c18808ea3469e7a5ae35746e5..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463</span></a><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><span lang="EN-US" style="font-family:"Arial",sans-serif;color:#0E101A">The following motion has been proposed by Chris Clements and Ryan Dickson of Google (Chrome Root Program) and endorsed by Aaron Gable (ISRG / Let Encrypt) and Wayne
Thayer (Fastly). </span><span lang="EN-US"><o:p></o:p></span></p>
<p style="margin:0mm"><span lang="EN-US"><o:p> </o:p></span></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">?Motion Begins ?/span><o:p></o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">This ballot modifies the aseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates?(aseline Requirements?, based on Version
2.0.4.<o:p></o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">MODIFY the Baseline Requirements as specified in the following Redline:<o:p></o:p></span></b></p>
<p style="margin:0mm"><span lang="EN-US"><a href="https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463"><b><span style="font-family:"Arial",sans-serif">https://github.com/cabforum/servercert/compare/c4a34fe2292022e0a04ba66b5a85df75907ac2a2..2dcf1a8fe5fc7b6a864b5767ab1db718bc447463</span></b></a></span><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black"> <o:p></o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">?Motion Ends ?/span><o:p></o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:<o:p></o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">Discussion (57 days)<o:p></o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- Start: 2024-05-20 14:30:00 UTC<o:p></o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- End: 2024-07-15 15:29:59 UTC<o:p></o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">Vote for approval (7 days)<o:p></o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- Start: 2024-07-15 15:30:00 UTC<o:p></o:p></span></b></p>
<p style="margin:0mm"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black">- End: 2024-07-22 15:30:00 UTC<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span lang="EN-US" style="font-family:"Arial",sans-serif;color:black"><o:p> </o:p></span></b></p>
</div>
</div>
</body>
</html>