<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:452990037;
mso-list-template-ids:2130446756;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1
{mso-list-id:1789811226;
mso-list-template-ids:-728061094;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Yes, thank you very much for helping make sure we’re all on the same page about the ballot’s intent and interpretation. These things are tricky to get right.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Tim<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Smcwg-public <smcwg-public-bounces@cabforum.org>
<b>On Behalf Of </b>Pedro FUENTES via Smcwg-public<br>
<b>Sent:</b> Thursday, September 29, 2022 3:05 PM<br>
<b>To:</b> Clint Wilson <clintw@apple.com><br>
<b>Cc:</b> SMIME Certificate Working Group <smcwg-public@cabforum.org><br>
<b>Subject:</b> Re: [Smcwg-public] [EXTERNAL]-Re: Ballot SMC01: Final Guideline for “S/MIME Baseline Requirements”<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi Clint,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">I totally agree with your views, and even when this is not impacting us, it’s always good to be sure a rule is endorsed with the right consensus. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">BR/P<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal" style="margin-bottom:12.0pt">Le 29 sept. 2022 à 20:20, Clint Wilson <<a href="mailto:clintw@apple.com">clintw@apple.com</a>> a écrit :<o:p></o:p></p>
</blockquote>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">Hi Pedro,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">There may well be impact to both the ideal wording in the guidelines, and to impacted practices. The goal, as I understand it, is at a high-level to establish a set of requirements which define processes that result in a consistent output
of information in a certificate, assuming the same input, regardless of issuing CA. As I understand current practices, achieving this goal will absolutely necessitate
<i>some</i> alteration to <i>some</i> implemented practices.<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Sep 29, 2022, at 7:41 AM, Pedro FUENTES <<a href="mailto:pfuentes@WISEKEY.COM">pfuentes@WISEKEY.COM</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Thanks, Clint. Therefore, your understanding is that the C/ST/L are related always to the O, and not to the person that is getting the certificate. This definitely implies to change the current writing of the guidelines, as we noticed yesterday.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">To be in the same page, these examples would be <b>impacted</b> practices:<o:p></o:p></p>
</div>
<div>
<ul type="disc">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo1">
Company “Foo” is registered in the US. There’s an employee that represents the company sales operation in Mexico, but there’s not Mexican registered company. In this case the employee can’t get a certificate stating “Mexico” as country. His certificate must
always include “C=US”<o:p></o:p></li></ul>
</div>
</div>
</div>
</blockquote>
<p class="MsoNormal">This reflects my understanding.<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<ul type="disc">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo2">
Company “Bar” is registered in California, USA. There’s an employee working in the Chicago office, but this is just a sales office. All important operations (e.g. Billing) are in California. In this case the employee can’t get a certificate stating “Illinois”
as State. His certificate must always include “ST=California, C=US”<o:p></o:p></li></ul>
</div>
</div>
</div>
</blockquote>
<p class="MsoNormal">That also sounds correct, in most cases. If we add that “Bar” is
<b>not</b> registered in Illinois nor Chicago, then I think it becomes correct in all cases.<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Are we OK with that?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As I said at the beginning, currently we use the registered address information and this is not an issue for us in particular, but I mostly want to open a discussion to ensure we are all in the same page, and to know what will be eventually
forbidden.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">BR/P<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On 29 Sep 2022, at 15:58, Clint Wilson <<a href="mailto:clintw@apple.com">clintw@apple.com</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">My understanding is as follows: where present, the legal entity identified in the Subject (i.e. the “O” field) is the legal entity used to populate the C, ST, and L fields as well (again, where present). That is, if there is an organization
named “Foo”, and it is registered as “Foo” in South Africa, Australia, Germany, and Brazil, then it can use “Foo” as the O, and different certificates could have different C, ST, L values representing that legal entity in South Africa, Australia, Germany,
or Brazil. If that same organization had a subsidiary or similar registered as “Bar” in Bulgaria, Japan, and Canada, it could use “Bar” as the O, and different certificates could have the C, ST, and L values related to Bulgaria, Japan, and Canada. “Foo” could
not appear with Japan as the country, and “Bar” could not appear with Germany as the country, as those legal entities are not registered in those respective countries.<o:p></o:p></p>
<div>
<p class="MsoNormal">Would it help to convey the “groupings” of subjectDN values, with the goal of making it clearer what values are being populated with the same base/source data? <o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Sep 29, 2022, at 3:55 AM, Pedro FUENTES via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org">smcwg-public@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Well… I don’t say that it’s confusing, what I’d say is that “country of operation” is a very vague concept…<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">You seem to understand that the company needs to have registered offices to operate in a country, but there are companies that operate in countries where they have people working from home (i.e. sales staff). <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I don’t think we can assimilate directly concepts of BRSSL here, because in SSL the subscriber is an entity that can be an individual or a company, but there’s a clear and direct relationship between the organization name in the TLS certificates
and the subscriber… In the case of SMIME this relationship between the subscriber and the organisation is not so clear at first sight.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Also, we could need to extend this discussion to the ST (and L, eventually), not only to the country.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">BR/P<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On 29 Sep 2022, at 12:27, Dimitris Zacharopoulos (HARICA) <<a href="mailto:dzacharo@harica.gr">dzacharo@harica.gr</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
<br>
On 29/9/2022 12:59 μ.μ., Pedro FUENTES wrote:<br>
<br>
<o:p></o:p></p>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<p class="MsoNormal">Txs. Then it could be understood that the country of the employee could be considered as a country where the company operates… I’m OK with that, and I support this interpretation, but this is not what was discussed yesterday, so we should
see about the consensus on this topic.<o:p></o:p></p>
</blockquote>
<p class="MsoNormal"><br>
Why is this confusing? The CA must validate that the company operates (i.e. has registered offices) at a certain location. Then, this country can be used in a sponsored validated profile. If an employee is working remotely in a country where the company does
not have registered offices, then that country cannot be used in a sponsored validated profile.<br>
<br>
Thanks,<br>
Dimitris.<o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:8.5pt;color:#F62400"><br>
WISeKey SA</span></b><o:p></o:p></p>
<div>
<p class="MsoNormal"><b><span style="font-size:8.5pt">Pedro Fuentes<br>
</span></b><span style="font-size:8.5pt">CSO - Trust Services Manager</span><span style="font-size:9.0pt"><br>
</span><span style="font-size:7.5pt">Office: + 41 (0) 22 594 30 00<br>
Mobile: + 41 (0) </span><span style="font-size:10.0pt">791 274 790</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt">Address: Avenue Louis-Casaï 58 | </span><span style="font-size:10.0pt">1216 Cointrin | Switzerland</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:9.0pt">Stay connected with <a href="http://www.wisekey.com/"><span style="color:#F62400">WISeKey</span></a><br>
</span></b><span style="font-size:7.5pt;color:darkgray"><br>
<br>
</span><o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:7.5pt;color:#78A600">THIS IS A TRUSTED MAIL</span></b><span style="font-size:7.5pt;color:#78A600">: This message is digitally signed with a WISeKey identity. If you get a mail from WISeKey please check the signature
to avoid security risks</span><span style="font-size:9.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.0pt;color:darkgray"><br>
<br>
</span><span style="font-size:9.0pt"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:7.0pt;color:darkgray">CONFIDENTIALITY: </span></b><span style="font-size:7.0pt;color:darkgray">This email and any files transmitted with it can be confidential and it’s intended solely for the use of the individual or
entity to which they are addressed. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. If you have received this email in error please notify the sender</span><span style="font-size:9.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:7.0pt;color:darkgray">DISCLAIMER: </span></b><span style="font-size:7.0pt;color:darkgray">WISeKey does not warrant the accuracy or completeness of this message and does not accept any liability for any errors or
omissions herein as this message has been transmitted over a public network. Internet communications cannot be guaranteed to be secure or error-free as information may be intercepted, corrupted, or contain viruses. Attachments to this e-mail are checked for
viruses; however, we do not accept any liability for any damage sustained by viruses and therefore you are kindly requested to check for viruses upon receipt.</span><span style="font-size:9.0pt"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Smcwg-public mailing list<br>
<a href="mailto:Smcwg-public@cabforum.org">Smcwg-public@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:8.5pt;color:#F62400"><br>
WISeKey SA</span></b><o:p></o:p></p>
<div>
<p class="MsoNormal"><b><span style="font-size:8.5pt">Pedro Fuentes<br>
</span></b><span style="font-size:8.5pt">CSO - Trust Services Manager</span><span style="font-size:9.0pt"><br>
</span><span style="font-size:7.5pt">Office: + 41 (0) 22 594 30 00<br>
Mobile: + 41 (0) </span><span style="font-size:10.0pt">791 274 790</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.5pt">Address: Avenue Louis-Casaï 58 | </span><span style="font-size:10.0pt">1216 Cointrin | Switzerland</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:9.0pt">Stay connected with <a href="http://www.wisekey.com/"><span style="color:#F62400">WISeKey</span></a><br>
</span></b><span style="font-size:7.5pt;color:darkgray"><br>
<br>
</span><o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:7.5pt;color:#78A600">THIS IS A TRUSTED MAIL</span></b><span style="font-size:7.5pt;color:#78A600">: This message is digitally signed with a WISeKey identity. If you get a mail from WISeKey please check the signature
to avoid security risks</span><span style="font-size:9.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:7.0pt;color:darkgray"><br>
<br>
</span><span style="font-size:9.0pt"><o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><b><span style="font-size:7.0pt;color:darkgray">CONFIDENTIALITY: </span></b><span style="font-size:7.0pt;color:darkgray">This email and any files transmitted with it can be confidential and it’s intended solely for the use of the individual or
entity to which they are addressed. If you are not the named addressee you should not disseminate, distribute or copy this e-mail. If you have received this email in error please notify the sender</span><span style="font-size:9.0pt"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:9.0pt"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><b><span style="font-size:7.0pt;color:darkgray">DISCLAIMER: </span></b><span style="font-size:7.0pt;color:darkgray">WISeKey does not warrant the accuracy or completeness of this message and does not accept any liability for any errors or
omissions herein as this message has been transmitted over a public network. Internet communications cannot be guaranteed to be secure or error-free as information may be intercepted, corrupted, or contain viruses. Attachments to this e-mail are checked for
viruses; however, we do not accept any liability for any damage sustained by viruses and therefore you are kindly requested to check for viruses upon receipt.</span><span style="font-size:9.0pt"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
</body>
</html>