<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe UI";
panose-1:2 11 5 2 4 2 4 2 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.xmsonormal, li.xmsonormal, div.xmsonormal
{mso-style-name:x_msonormal;
margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle22
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Thank you for the clarification Karina. <o:p></o:p></p>
<p class="MsoNormal">I will draft corresponding amendments to the S/MIME BR for discussion on the SMCWG call this Wednesday.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">With kind regards, Stephen<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Smcwg-public <smcwg-public-bounces@cabforum.org>
<b>On Behalf Of </b>Karina Sirota Goodley via Smcwg-public<br>
<b>Sent:</b> Sunday, October 9, 2022 7:31 PM<br>
<b>To:</b> Paul van Brouwershaven <Paul.vanBrouwershaven@entrust.com>; SMIME Certificate Working Group <smcwg-public@cabforum.org><br>
<b>Subject:</b> Re: [Smcwg-public] [EXTERNAL] Microsoft requirements for OCSP URLs in S/MIME certificates<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="color:#1F497D">Yes, the correction is correct.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="624" style="width:6.5in;border-collapse:collapse">
<tbody>
<tr>
<td width="468" colspan="2" valign="top" style="width:351.0pt;padding:0in 0in 0in 0in">
<p class="MsoNormal" style="vertical-align:baseline"><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:#505050">Best,
<o:p></o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:#505050">Karina<o:p></o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black"><o:p> </o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="font-size:10.0pt;font-family:"Segoe UI",sans-serif;color:black">Karina Sirota Goodley | Security Program Manager 2</span><span style="color:#505050"><o:p></o:p></span></p>
</td>
</tr>
<tr style="height:50.25pt">
<td width="360" valign="top" style="width:269.8pt;padding:0in 0in 0in 0in;height:50.25pt">
<p class="MsoNormal" style="vertical-align:baseline"><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#595959">Trusted Root Program, Trust Governance and Resilience</span><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#1F497D"> <o:p></o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="font-size:8.0pt;font-family:"Segoe UI",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><i><span style="font-size:9.0pt;color:#1F497D">After-hours responses neither required nor expected.
</span></i><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal" style="vertical-align:baseline"><span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
</td>
<td width="144" style="width:1.5in;padding:0in 0in 0in 0in;height:50.25pt">
<p class="MsoNormal"> <o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Paul van Brouwershaven <<a href="mailto:Paul.vanBrouwershaven@entrust.com">Paul.vanBrouwershaven@entrust.com</a>>
<br>
<b>Sent:</b> Sunday, October 9, 2022 1:14 PM<br>
<b>To:</b> Karina Sirota Goodley <<a href="mailto:Karina.Sirota@microsoft.com">Karina.Sirota@microsoft.com</a>>; SMIME Certificate Working Group <<a href="mailto:smcwg-public@cabforum.org">smcwg-public@cabforum.org</a>><br>
<b>Cc:</b> Karina Sirota Goodley <<a href="mailto:Karina.Sirota@microsoft.com">Karina.Sirota@microsoft.com</a>><br>
<b>Subject:</b> Re: [EXTERNAL] [Smcwg-public] Microsoft requirements for OCSP URLs in S/MIME certificates<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" align="left" width="100%" style="width:100.0%">
<tbody>
<tr>
<td style="background:#A6A6A6;padding:5.25pt 1.5pt 5.25pt 1.5pt"></td>
<td width="100%" style="width:100.0%;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 11.25pt">
<div>
<p class="MsoNormal" style="mso-element:frame;mso-element-frame-hspace:2.25pt;mso-element-wrap:around;mso-element-anchor-vertical:paragraph;mso-element-anchor-horizontal:column;mso-height-rule:exactly">
<span style="font-size:9.0pt;font-family:"Segoe UI",sans-serif;color:#212121">You don't often get email from
<a href="mailto:paul.vanbrouwershaven@entrust.com">paul.vanbrouwershaven@entrust.com</a>.
<a href="https://aka.ms/LearnAboutSenderIdentification">Learn why this is important</a><o:p></o:p></span></p>
</div>
</td>
<td width="75" style="width:56.25pt;background:#EAEAEA;padding:5.25pt 3.75pt 5.25pt 3.75pt;align:left">
</td>
</tr>
</tbody>
</table>
<div>
<div>
<p class="MsoNormal">Hi Karina,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">> OCSP is not optional for TLS at this time. Thus, we will be changing our policy to : “<u>All non-TLS</u> end-entity certificates must contain an AIA extension with a valid OCSP URL”. We will continue to investigate OCSP for TLS.
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Do you mean: “<u>All TLS</u> end-entity certificates must contain an AIA extension with a valid OCSP URL”<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Paul<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="divRplyFwdMsg">
<p class="MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> Smcwg-public <<a href="mailto:smcwg-public-bounces@cabforum.org">smcwg-public-bounces@cabforum.org</a>> on behalf of Karina Sirota Goodley via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org">smcwg-public@cabforum.org</a>><br>
<b>Sent:</b> Sunday, October 9, 2022 8:08:42 PM<br>
<b>To:</b> <a href="mailto:smcwg-public@cabforum.org">smcwg-public@cabforum.org</a> <<a href="mailto:smcwg-public@cabforum.org">smcwg-public@cabforum.org</a>><br>
<b>Cc:</b> Karina Sirota Goodley <<a href="mailto:Karina.Sirota@microsoft.com">Karina.Sirota@microsoft.com</a>><br>
<b>Subject:</b> [EXTERNAL] [Smcwg-public] Microsoft requirements for OCSP URLs in S/MIME certificates</span>
<o:p></o:p></p>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal">WARNING: This email originated outside of Entrust.<br>
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<div>
<p class="xmsonormal">Hi all, <o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal">In regards to the question of Microsoft requirements for OCSP URLs in S/MIME certificates, I had to do quite a bit of digging around the various teams across Microsoft. However, I can confirm that OCSP can be optional for any non-TLS certificate
types. This includes S/MIME. <o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal">OCSP is not optional for TLS at this time. Thus, we will be changing our policy to : “All non-TLS end-entity certificates must contain an AIA extension with a valid OCSP URL”. We will continue to investigate OCSP for TLS.
<o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal">Best, <o:p></o:p></p>
<p class="xmsonormal">Karina Sirota Goodley<o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
<p class="xmsonormal"> <o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><i>Any email and files/attachments transmitted with it are confidential and are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute
or disclose of the information it contains. <u>Please notify Entrust immediately</u> and delete the message from your system.</i>
<o:p></o:p></p>
</div>
</div>
</body>
</html>