<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 10/3/2022 2:22 μ.μ., Doug Beattie
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:PUZPR03MB6129A1F67740A9972C0EE447F00B9@PUZPR03MB6129.apcprd03.prod.outlook.com"><span
style="color:#548235;mso-style-textfill-fill-color:#548235;mso-style-textfill-fill-alpha:100.0%">If
there are usecases that demand more, then let’s let them define
those rules and policy OIDs to be used in the certificates on
top of the profiles we’re defining here.</span></blockquote>
<br>
I'm afraid I can't support that position. We have always had rules
to include validated information in the certificates, even "any
other method" that the CA deems appropriate. Even for the
subject:organizationalUnitName field, there were rules describing
what the CA MUST NOT allow. Allowing fields without any vetting
whatsoever is not correct IMHO. It should not be considered
"appropriate" from the CA because it is not performing any sort of
validation!<br>
<br>
BTW, I agree with the position to bring in use cases and define
rules. The WG needs to be a bit more active in that regard because
it is the only way that existing use cases will be discussed,
analyzed and safe practices included in the SMBRs. However, until we
have those use cases brought forward so that the WG can define
rules, I believe we should not allow them.<br>
<br>
Dimitris.<br>
</body>
</html>