<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:12.0pt;
font-family:"Aptos",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#467886;
text-decoration:underline;}
span.EstiloCorreo19
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=ES link="#467886" vlink="#96607D" style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Here are the 2024-07-18 final minutes for the servercert-wg meeting.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'># Attendees</span></b><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Aaron Gable (Let's Encrypt), Aaron Poulsen (Amazon), Adrian Mueller (SwissSign), Adriano Santoni (Actalis S.p.A.), Andrea Holland (VikingCloud), Ben Wilson (Mozilla), Bruce Morton (Entrust), Chad Dandar (Cisco Systems), Corey Bonnell (DigiCert), Corey Rasmussen (OATI), Dean Coclin (DigiCert), Dimitris Zacharopoulos (HARICA), Doug Beattie (GlobalSign), Dustin Hollenback (Microsoft), Inaba Atsushi (GlobalSign), Jaime Hablutzel (OISTE Foundation), Janet Hines (VikingCloud), Johnny Reading (GoDaddy), Karina Sirota (Microsoft), Lynn Jeun (Visa), Marco Schambach (IdenTrust), Martijn Katerbarg (Sectigo), Michelle Coon (OATI), Nargis Mannan (VikingCloud), Nate Smith (GoDaddy), Nicol So (CommScope), Peter Miskovic (Disig), Rebecca Kelly (SSL.com), Rollin Yu (TrustAsia), Sandy Balzer (SwissSign), Scott Rea (eMudhra), Stephen Davidson (DigiCert), Tadahiko Ito (SECOM Trust Systems), Thomas Zermeno (SSL.com), Tobias Josefowitz (Opera Software AS), Wayne Thayer (Fastly), Wendy Brown (US Federal PKI Management Authority), Yamian Quintero (Microsoft)<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'># Minutes</span></b><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Dustin read the Note Well.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Interested Party applications for Mike Shaver and Amir Omidi were approved.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>June 20th meeting minutes were approved.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>## Ballot Status</span></b><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>1. SC-75 (pre-issuance linting): Passed<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>2. SC-67 (MPIC): In voting period<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>3. SC-xx (Profiles cleanup ballot): On hold<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>4. SC-71 (Terms of Use/Subscriber Agreement): On hold, will resume soon<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>## Issues to discuss</span></b><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>### Github issue </span></b><a href="https://github.com/mozilla/pkipolicy/issues/280"><b><span lang=EN-US style='font-size:11.0pt'>https://github.com/mozilla/pkipolicy/issues/280</span></b></a><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Ben provided the background on this issue. Ben said that the issue is relevant<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>to both pre-certificates and final certificates. Within a certain period of time,<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>the CA must globally distribute the corresponding for Relying Parties. Ben's initial<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>suggestion is 15 minutes after issuance, but the discussion continues.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Aaron said that establishing this grace period is a good idea, as we have done similar<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>for CRLs. Aaron said he does not feel strongly on the exact time period (15 minutes vs. 1 hour).<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Aaron is unsure that we should explicitly reference "unused" and "reserved", as "reserved"<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>serial numbers do not exist. This is something that should be cleaned up in </span><a href="https://github.com/cabforum/servercert/issues/422"><span lang=EN-US style='font-size:11.0pt'>https://github.com/cabforum/servercert/issues/422</span></a><span lang=EN-US style='font-size:11.0pt'>. There was agreement by Dimitris and Martijn that this language needs<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>to be improved.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Aaron said there is another related issue in that there is a BR requirement for the CA to operate a revocation status service, but there are other passages that outline similar requirements. It would be useful to make these consistent.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Ben revisited the grace period topic on whether to use 15 minutes or 1 hour. Aaron and Dimitris agreed that 15 minutes is sufficient. Ben raised the concern that many bugs may be filed for minor infractions of an arbitrary requirement. Aaron suggested that someone should write a ballot to overhaul section 4.9.10 and suggest a time period. Then participants can discuss the concrete proposal. Ben agreed to take this on.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>### Github issue </span></b><a href="https://github.com/cabforum/servercert/issues/436"><b><span lang=EN-US style='font-size:11.0pt'>https://github.com/cabforum/servercert/issues/436</span></b></a><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Martijn said this issue is similar to the Extant CA sunset for the SMIME BRs, where ICA<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>certificates that do not comply with the current profile are sunsetted. Ben mentioned it<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>would be good to have a list of ICAs that do not comply with the current profile to determine<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>potential impact. It was suggested to use a linter to determine this. Since pkilint is up to date with SC-62 requirement, it was further suggested to use pkilint for this analysis. Martijn took an action item to do this analysis.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>### Github issue </span></b><a href="https://github.com/cabforum/servercert/issues/437"><b><span lang=EN-US style='font-size:11.0pt'>https://github.com/cabforum/servercert/issues/437</span></b></a><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>No discussion.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>### Github issue </span></b><a href="https://github.com/cabforum/servercert/issues/438"><b><span lang=EN-US style='font-size:11.0pt'>https://github.com/cabforum/servercert/issues/438</span></b></a><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>This issue in particular wasn't discussed, but Ben suggested that it would be good to look at<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>only cleanup items so that we can produce a cleanup ballot after this review. Corey agreed and said<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>that is a more efficient use of time.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>### Github issue </span></b><a href="https://github.com/cabforum/servercert/issues/442"><b><span lang=EN-US style='font-size:11.0pt'>https://github.com/cabforum/servercert/issues/442</span></b></a><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Ben said this issue may be difficult to resolve, as it is difficult to define exactly what "made aware" means. Wayne said that SC-73 partially reserved the issue.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>### Github issue </span></b><a href="https://github.com/cabforum/servercert/issues/443"><b><span lang=EN-US style='font-size:11.0pt'>https://github.com/cabforum/servercert/issues/443</span></b></a><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>It was agreed that this issue can be closed.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>### Github issue </span></b><a href="https://github.com/cabforum/servercert/issues/444"><b><span lang=EN-US style='font-size:11.0pt'>https://github.com/cabforum/servercert/issues/444</span></b></a><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Dimitris said that we should add a reference to the appropriate section where name constraints are addressed.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><b><span lang=EN-US style='font-size:11.0pt'>## Other business</span></b><span lang=EN-US style='font-size:11.0pt'><o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'>Dustin adjourned the meeting.<o:p></o:p></span></p><p class=MsoNormal><span lang=EN-US style='font-size:11.0pt'><o:p> </o:p></span></p></div></body></html>