<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle21
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1418675336;
mso-list-template-ids:-1942730856;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:12.0pt">FYI, for thoroughness: MDSP announcement re S/MIME BR.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt">Regards, Stephen<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:12.0pt">From:</span></b><span style="font-size:12.0pt"> dev-security-policy@mozilla.org <dev-security-policy@mozilla.org>
<b>On Behalf Of </b>Ben Wilson<br>
<b>Sent:</b> Friday, June 16, 2023 1:37 PM<br>
<b>To:</b> dev-secur...@mozilla.org <dev-security-policy@mozilla.org><br>
<b>Subject:</b> MRSP 2.9: S/MIME BRs Transition Timeline<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<div>
<p style="mso-margin-top-alt:12.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:0in">
<span style="font-size:12.0pt;color:black">Greetings,</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:0in">
<span style="font-size:12.0pt;color:black">Our proposal for a migration plan towards having Certification Authorities (CAs) follow the CA/Browser Forum’s Baseline Requirements for S/MIME Certificates (S/MIME BRs) is as follows, keeping in mind that the Effective
Date for version 1.0.0 of the S/MIME BRs is September 1, 2023, and assuming that ETSI and WebTrust audit criteria are in place for S/MIME BR audits by September 1, 2023.</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:0in">
<span style="font-size:12.0pt;color:black">Any root CA certificate being considered for inclusion after September 1, 2023, must be audited according to the S/MIME BRs if the email trust bit is to be enabled, and the CA operator’s CP or CPS must state that they
follow the current version of the S/MIME BRs. Note that the CA operator’s first S/MIME BR audit may be a Point-in-Time audit if the audit period will be less than 60 days, and the audit statement may list non-compliances to be resolved within the next annual
audit period. </span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p style="mso-margin-top-alt:12.0pt;margin-right:0in;margin-bottom:12.0pt;margin-left:0in">
<span style="font-size:12.0pt;color:black">CA root certificates and subordinate CA certificates that are technically capable of issuing S/MIME certificates that chain up (either directly or transitively) to a root certificate that has the email (S/MIME) trust
bit enabled in Mozilla's CA Certificate Program shall be audited with a Period-of-Time audit according to the S/MIME BRs between September 1, 2023, and August 31, 2024, and annually thereafter. For CA operators to maintain their current annual audit cycles,
the new S/MIME BR audit should be provided along with the other audits that the CA operator provides annually.</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<ul style="margin-top:0in" type="disc">
<li style="color:black;margin-top:12.0pt;margin-bottom:0in;mso-list:l0 level1 lfo1;vertical-align:baseline">
<span style="font-size:12.0pt">The audit period start date for the first S/MIME BR audit will be September 1, 2023, or earlier.<o:p></o:p></span></li></ul>
<ul style="margin-top:0in" type="disc">
<ul style="margin-top:0in" type="circle">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l0 level2 lfo1;vertical-align:baseline">
<span style="font-size:12.0pt">At the CA operator’s option, the first S/MIME BR audit may cover the entire audit period.<o:p></o:p></span></li><li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l0 level2 lfo1;vertical-align:baseline">
<span style="font-size:12.0pt">The initial audit period start date for the first S/MIME BR audit cannot be before the effective date of a CA operator’s CP or CPS that confirms the CA operator’s compliance with the current version of the S/MIME BRs.<o:p></o:p></span></li></ul>
</ul>
<ul style="margin-top:0in" type="disc">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l0 level1 lfo1;vertical-align:baseline">
<span style="font-size:12.0pt">If the CA operator’s existing regular audit period for other audit types ends after October 30, 2023, then we will expect to receive an S/MIME BR audit that covers September 1, 2023, through the end of that audit period (i.e.
a Period-of-Time audit).<o:p></o:p></span></li></ul>
<ul style="margin-top:0in" type="disc">
<ul style="margin-top:0in" type="circle">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l0 level2 lfo1;vertical-align:baseline">
<span style="font-size:12.0pt">If the CA operator’s first S/MIME BR audit period would be less than 60 days (e.g. audit period being September 1, 2023, to October 30, 2023), then a Point-in-Time audit may be performed. <o:p></o:p></span></li></ul>
</ul>
<ul style="margin-top:0in" type="disc">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l0 level1 lfo1;vertical-align:baseline">
<span style="font-size:12.0pt">The first S/MIME BR audit for each CA root certificate and subordinate CA certificate may include a reasonable list of non-compliances that the CA operator (or subordinate CA operator) is not yet in compliance with.<o:p></o:p></span></li></ul>
<ul style="margin-top:0in" type="disc">
<ul style="margin-top:0in" type="circle">
<li style="color:black;margin-top:0in;margin-bottom:0in;mso-list:l0 level2 lfo1;vertical-align:baseline">
<span style="font-size:12.0pt">Only one Incident Bug needs to be filed containing the list of the non-compliances in a CA operator’s first S/MIME BR audit.<o:p></o:p></span></li></ul>
</ul>
<ul style="margin-top:0in" type="disc">
<li style="color:black;margin-top:0in;margin-bottom:12.0pt;mso-list:l0 level1 lfo1;vertical-align:baseline">
<span style="font-size:12.0pt">Submission of the second S/MIME BR audit report is expected to confirm that the issues that were listed in the first S/MIME BR audit report have been resolved. <o:p></o:p></span></li></ul>
<p style="margin:0in"><span style="font-size:12.0pt;color:black">We look forward to your constructive feedback on the proposed transition timeline.</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p style="margin:0in"><span style="font-size:12.0pt;color:black">Regards,</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt"><o:p> </o:p></span></p>
<p style="margin:0in"><span style="font-size:12.0pt;color:black">Ben and Kathleen</span><span style="font-size:12.0pt"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:12.0pt">-- <br>
You received this message because you are subscribed to the Google Groups "<a href="mailto:dev-security-policy@mozilla.org">dev-security-policy@mozilla.org</a>" group.<br>
To unsubscribe from this group and stop receiving emails from it, send an email to
<a href="mailto:dev-security-policy+unsubscribe@mozilla.org">dev-security-policy+unsubscribe@mozilla.org</a>.<br>
To view this discussion on the web visit <a href="https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/CA%2B1gtabGSZqHeAF1BkaepgYXh73-c12%3DrxfChiUfPcC10TaH0Q%40mail.gmail.com?utm_medium=email&utm_source=footer">
https://groups.google.com/a/mozilla.org/d/msgid/dev-security-policy/CA%2B1gtabGSZqHeAF1BkaepgYXh73-c12%3DrxfChiUfPcC10TaH0Q%40mail.gmail.com</a>.<o:p></o:p></span></p>
</div>
</body>
</html>