<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<br>
<br>
<div class="moz-cite-prefix">On 23/9/2022 9:13 μ.μ., Tim Hollebeek
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:SJ0PR14MB5489A4D3B8538D4DBC7EAB5C83519@SJ0PR14MB5489.namprd14.prod.outlook.com">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}div.WordSection1
{page:WordSection1;}</style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We would support this if a Microsoft
representative publicly makes a statement clarifying that
their OCSP requirements in Microsoft policy are not intended
to apply to non-TLS certificates and/or updates their policy
to state the same.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I would encourage them to do so because I
personally believe that is in fact the original intent of the
policy, but the problem is that our compliance team (and other
compliance teams…) cannot rely upon my personal beliefs.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</blockquote>
<br>
I completely understand the sentiments from compliance teams when it
comes to merging different policy requirements. Having OCSP optional
in the SMBRs doesn't mean that a CA that wants to abide with any
additional rules can't do so. However, requiring it in the SMBRs
doesn't allow other CAs, like HARICA, that have a written statement
from a Microsoft representative, to see OCSP as optional because it
would cause a non-comformity in the audit report which can only be
mitigated by.... revoking all certs and adding OCSP support :)<br>
<br>
Hopefully this explains HARICA's difficult situation.<br>
<br>
If there is no consensus to remove the mandatory requirement of the
OCSP URL in this version of the ballot, my recommendation would be
to defer this topic for the upcoming F2F where we will have 3
Microsoft representatives (2 physically present and 1 remote) to
hopefully comment and clarify the situation.<br>
<br>
<br>
Thanks,<br>
Dimitris.<br>
<br>
<br>
<br>
<br>
<blockquote type="cite"
cite="mid:SJ0PR14MB5489A4D3B8538D4DBC7EAB5C83519@SJ0PR14MB5489.namprd14.prod.outlook.com">
<div class="WordSection1">
<p class="MsoNormal">-Tim<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in
0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1
1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Smcwg-public
<a class="moz-txt-link-rfc2396E" href="mailto:smcwg-public-bounces@cabforum.org"><smcwg-public-bounces@cabforum.org></a>
<b>On Behalf Of </b>Dimitris Zacharopoulos (HARICA) via
Smcwg-public<br>
<b>Sent:</b> Friday, September 23, 2022 1:53 PM<br>
<b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:smcwg-public@cabforum.org">smcwg-public@cabforum.org</a><br>
<b>Subject:</b> [Smcwg-public] OCSP URLs in S/MIME
Certificates<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
I dug up some emails HARICA exchanged with Microsoft Root
Program Managers back in June 2021. We indicated that the
Root Store Policy at-that-time had a "catch-all" phrase
implying that OCSP URLs must be included in all Certificates
trusted by Microsoft.<br>
<br>
After it was pointed out by a Microsoft representative that
it is not required for Code Signing Certificates, we reached
out to Microsoft asking what is the case for other types of
certificates. Their response was:<br>
<br>
<span style="color:#1F497D">"Removing the OCSP URLs from
non-TLS certificates is acceptable."</span><br>
<br>
I know this is not a "normative statement" but for me it
confirms that OCSP is not required for S/MIME Certificates
in the Microsoft Root Program. So, unless there is an
opposing statement by Microsoft, I hope we can agree to
change the OCSP requirement from mandatory to optional in
the first version of the SMBRs.<br>
<br>
Thank you,<br>
Dimitris.<o:p></o:p></p>
</div>
</div>
</blockquote>
<br>
</body>
</html>