<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Regarding name constrains on email addresses in subordinate CA certificates, RFC 5280 says:<div class=""><br class=""></div><div class=""><div class=""> A name constraint for Internet mail addresses MAY specify a</div><div class=""> particular mailbox, all addresses at a particular host, or all</div><div class=""> mailboxes in a domain. To indicate a particular mailbox, the</div><div class=""> constraint is the complete mail address. For example,</div><div class=""> "<a href="mailto:root@example.com" class="">root@example.com</a>" indicates the root mailbox on the host</div><div class=""> "<a href="http://example.com" class="">example.com</a>". To indicate all Internet mail addresses on a</div><div class=""> particular host, the constraint is specified as the host name. For</div><div class=""> example, the constraint "<a href="http://example.com" class="">example.com</a>" is satisfied by any mail</div><div class=""> address at the host "<a href="http://example.com" class="">example.com</a>". To specify any address within a</div><div class=""> domain, the constraint is specified with a leading period (as with</div><div class=""> URIs). For example, ".<a href="http://example.com" class="">example.com</a>" indicates all the Internet mail</div><div class=""> addresses in the domain "<a href="http://example.com" class="">example.com</a>", but not Internet mail</div><div class=""> addresses on the host "<a href="http://example.com" class="">example.com</a>".</div><div class=""><br class=""></div><div class="">I think it would be acceptable for a CA to validate control over a complete email address, such as "<a href="mailto:root@example.com" class="">root@example.com</a>". However, it is not possible for the CA to enumerate all of the addresses on a particular host or in a particular domain. So, in those cases, the validation needs to be for the domain.</div><div class=""><br class=""></div><div class="">Russ</div><div class=""><br class=""></div><div><br class=""><blockquote type="cite" class=""><div class="">On Feb 17, 2021, at 6:02 PM, Stephen Davidson via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org" class="">smcwg-public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Hello all:<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Following our discussion on the call today, I attach draft text for section 3.2.2.2 of the SMIME BR (SBR) that deals with 1) Validating authority over email address via domain and 2) Validating control over email address via email.<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">It aims to fulfill the requirements of the Mozilla policy. It includes comments with some questions that require further discussion. Additional methods can be addressed in future versions of the SBR.<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Many thanks for Doug and Sebastian at GlobalSign for their help in drafting this. We’ll discuss this in a future meeting, but feel free to also provide feedback here.<o:p class=""></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Many thanks, Stephen<o:p class=""></o:p></div></div><span id="cid:AECF43E1-9214-4591-9604-142E5D79A5D2@fios-router.home"><SBR - Draft email verification.pdf></span><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">Smcwg-public mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="mailto:Smcwg-public@cabforum.org" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">Smcwg-public@cabforum.org</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a></div></blockquote></div><br class=""></div></body></html>