<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">Doug, <div><br></div><div>See RFC 8823.</div><div><br></div><div>Russ<br><div><br><blockquote type="cite"><div>On Oct 2, 2023, at 6:27 AM, Doug Beattie via Smcwg-public <smcwg-public@cabforum.org> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I haven’t been following the status of ACME for S/MIME, but I presume there are some fields in that CSR that would be used to automate certificate issuance. Maybe that is a place to start looking for meaningful fields within a CSR? I know that we typically only pull out the public key from CSRs and all other info is provided outside of it.<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Doug<o:p></o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor; border-image: none; padding: 3pt 0in 0in;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><b>From:</b><span class="Apple-converted-space"> </span>Smcwg-public <<a href="mailto:smcwg-public-bounces@cabforum.org" style="color: blue; text-decoration: underline;">smcwg-public-bounces@cabforum.org</a>><span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Adriano Santoni via Smcwg-public<br><b>Sent:</b><span class="Apple-converted-space"> </span>Monday, October 2, 2023 2:57 AM<br><b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:smcwg-public@cabforum.org" style="color: blue; text-decoration: underline;">smcwg-public@cabforum.org</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Smcwg-public] [External Sender] Re: [EXTERNAL]-Re: Fields for S/MIME CSRs<o:p></o:p></div></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><p>Not necessarily: the email address can be transmitted to the CA as a separate datum.<span class="Apple-converted-space"> </span><o:p></o:p></p><p>Indeed, I would say that this is preferable because it allows syntax checking on the email address without even starting to look at the CSR, from which in my opinion only the public key should be taken.<o:p></o:p></p><p>Adriano<o:p></o:p></p><p><o:p> </o:p></p><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Il 29/09/2023 21:21, Ben Wilson via Smcwg-public ha scritto:<o:p></o:p></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div align="center"><table class="MsoNormalTable" border="1" cellpadding="0" width="30%" style="width: 338.390625px;"><tbody><tr><td valign="top" style="background: yellow; padding: 1.5pt;"><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><span style="color: red;">NOTICE:</span><span style=""><span class="Apple-converted-space"> </span>Pay attention - external email - Sender is<span class="Apple-converted-space"> </span><a href="mailto:0100018ae263a9a7-3e84e260-b7d7-43c5-85cb-d1425682cb27-000000@amazonses.com" style="color: blue; text-decoration: underline;">0100018ae263a9a7-3e84e260-b7d7-43c5-85cb-d1425682cb27-000000@amazonses.com</a></span><o:p></o:p></div></td></tr></tbody></table></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif; text-align: center;"><o:p> </o:p></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Shouldn't at least the email address be included, and verified, of course, by the CA?<o:p></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">On Fri, Sep 29, 2023, 11:35 AM Pedro FUENTES <<a href="mailto:pfuentes@wisekey.com" style="color: blue; text-decoration: underline;">pfuentes@wisekey.com</a>> wrote:<o:p></o:p></div></div><blockquote style="border-width: medium medium medium 1pt; border-style: none none none solid; border-color: currentcolor currentcolor currentcolor rgb(204, 204, 204); border-image: none; padding: 0in 0in 0in 6pt; margin-left: 4.8pt; margin-right: 0in;"><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">+1<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><p class="MsoNormal" style="margin: 0in 0in 12pt; font-size: 11pt; font-family: Calibri, sans-serif;">Le 29 sept. 2023 à 17:52, Clint Wilson via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org" target="_blank" style="color: blue; text-decoration: underline;">smcwg-public@cabforum.org</a>> a écrit :<o:p></o:p></p></blockquote></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Hi all,<span class="Apple-converted-space"> </span><o:p></o:p></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">In my opinion, CSRs should really be limited to conveying the public key and a proof of possession of the private key; the fields included therein<span class="Apple-converted-space"> </span><i>may</i><span class="Apple-converted-space"> </span>act as confirmatory signals for a CA, but shouldn’t be directly relied upon e.g. to generate a tbsCertificate. Rather, the values placed in fields of a tbsCertificate should originate from the CA’s validated data store to ensure that the only paths for data to become part of a signed certificate are through static configurations (e.g. signatureAlgorithm) or known-validated data.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">There’s plenty of nuance we can discuss as well, but generally speaking I believe it’s bad practice to rely on fields in the CSR.<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Cheers,<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">-Clint<o:p></o:p></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><o:p></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">On Sep 29, 2023, at 8:27 AM, Ben Wilson via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org" target="_blank" style="color: blue; text-decoration: underline;">smcwg-public@cabforum.org</a>> wrote:<o:p></o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div><div><div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">All,<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">I'm interested in gathering information from Certificate Issuers about the kind of information that they would like to collect/extract from the CSRs they receive from S/MIME certificate applicants. This information could be used to refine a system to generate CSRs that result in certificates compliant with the various profiles defined in the S/MIME BRs. Alternatively, what is the minimum amount of information that CAs might expect to obtain from CSRs? In other words, which fields should a CSR generator integrated with a Certificate Consumer's software support?<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Thanks,<o:p></o:p></div></div><div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">Ben<o:p></o:p></div></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">_______________________________________________<br>Smcwg-public mailing list<br><a href="mailto:Smcwg-public@cabforum.org" target="_blank" style="color: blue; text-decoration: underline;">Smcwg-public@cabforum.org</a><br><a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" target="_blank" style="color: blue; text-decoration: underline;">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a><o:p></o:p></div></div></blockquote></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><o:p> </o:p></div></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;">_______________________________________________<br>Smcwg-public mailing list<br><a href="mailto:Smcwg-public@cabforum.org" target="_blank" style="color: blue; text-decoration: underline;">Smcwg-public@cabforum.org</a><br><a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.cabforum.org_mailman_listinfo_smcwg-2Dpublic&d=DwICAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=SdzPRXhti18pWLmVPVZwDOe4My0SBGtWzL3HSt02tHKsXpWQUw9YUb_QzXtxZYtw&s=5yodJ9UuvfVvN_CqY53dyFJyNwYRRJDEfhmuysvXrQA&e=" target="_blank" style="color: blue; text-decoration: underline;">https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.cabforum.org_mailman_listinfo_smcwg-2Dpublic&d=DwICAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=SdzPRXhti18pWLmVPVZwDOe4My0SBGtWzL3HSt02tHKsXpWQUw9YUb_QzXtxZYtw&s=5yodJ9UuvfVvN_CqY53dyFJyNwYRRJDEfhmuysvXrQA&e=</a><o:p></o:p></div></div></blockquote></div></blockquote></div><div style="margin: 0in; font-size: 11pt; font-family: Calibri, sans-serif;"><br><br><o:p></o:p></div><pre style="margin: 0in; font-size: 10pt; font-family: "Courier New";">_______________________________________________<o:p></o:p></pre><pre style="margin: 0in; font-size: 10pt; font-family: "Courier New";">Smcwg-public mailing list<o:p></o:p></pre><pre style="margin: 0in; font-size: 10pt; font-family: "Courier New";"><a href="mailto:Smcwg-public@cabforum.org" style="color: blue; text-decoration: underline;">Smcwg-public@cabforum.org</a><o:p></o:p></pre><pre style="margin: 0in; font-size: 10pt; font-family: "Courier New";"><a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" style="color: blue; text-decoration: underline;">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a><o:p></o:p></pre></blockquote></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Smcwg-public mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="mailto:Smcwg-public@cabforum.org" style="color: blue; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Smcwg-public@cabforum.org</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" style="color: blue; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a></div></blockquote></div><br></div></body></html>