<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Would email address validation be enough to validate the same values also to Subject. E.g. if user is able to validate email address
<a href="mailto:helpdesk@company.com">helpdesk@company.com</a>, is it allowed for CA then to put value “helpdesk” to CN? This would solve our requirements for weakly validated Subjects and we could automate easily everything.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Br Pekka<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b>From:</b> Smcwg-public <smcwg-public-bounces@cabforum.org>
<b>On Behalf Of </b>Dimitris Zacharopoulos (HARICA) via Smcwg-public<br>
<b>Sent:</b> torstai 10. maaliskuuta 2022 14.59<br>
<b>To:</b> Doug Beattie <doug.beattie@globalsign.com>; SMIME Certificate Working Group <smcwg-public@cabforum.org>; Henschel, Andreas <a.henschel@d-trust.net><br>
<b>Subject:</b> Re: [Smcwg-public] [EXTERNAL]-Re: Common Name contents<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On 10/3/2022 2:22 μ.μ., Doug Beattie wrote:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal"><span style="color:#548235">If there are usecases that demand more, then let’s let them define those rules and policy OIDs to be used in the certificates on top of the profiles we’re defining here.</span><o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
I'm afraid I can't support that position. We have always had rules to include validated information in the certificates, even "any other method" that the CA deems appropriate. Even for the subject:organizationalUnitName field, there were rules describing what
the CA MUST NOT allow. Allowing fields without any vetting whatsoever is not correct IMHO. It should not be considered "appropriate" from the CA because it is not performing any sort of validation!<br>
<br>
BTW, I agree with the position to bring in use cases and define rules. The WG needs to be a bit more active in that regard because it is the only way that existing use cases will be discussed, analyzed and safe practices included in the SMBRs. However, until
we have those use cases brought forward so that the WG can define rules, I believe we should not allow them.<br>
<br>
Dimitris.<o:p></o:p></p>
</div>
<div style="font-size:9pt; font-family: 'Calibri',sans-serif;"><br>
<i>This email may contain information which is privileged or protected against unauthorized disclosure or communication. If you are not the intended recipient, please notify the sender and delete this message and any attachments from your system without producing,
distributing or retaining copies thereof or disclosing its contents to any other person.
<br>
<br>
Telia Company processes emails and other files that may contain personal data in accordance with Telia Company’s
<a href="https://www.teliacompany.com/en/about-the-company/privacy/">Privacy Policy</a>.</i>
<br>
<br>
<br>
</div>
</body>
</html>