<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hello all,</p>
<p>I have the impression that the current SMBRs allow to issue
Sponsor-Validated certificates which, contrary to the definition
of this type of certificate, do not contain any "Individual
(Natural Person) attributes" (quoting from the definition of
Sponsor-Validated). At least, this seems to hold for the "Legacy
Generation profiles".<br>
</p>
<ul>
<li>according to §3.1.1 and §7.1.4.2.2, the commonName does not
necessarily have to contain a Personal Name (in fact it MAY
contain a Mailbox Address)</li>
</ul>
<ul>
<li>according to §7.1.4.2.5, givenName and surname attributes are
not required in "Legacy Generation profiles".</li>
</ul>
<p>Furthermore, as already discussed in a previous thread, there is
no requirement that a personal email address have a "personal"
appearance (e.g. <a class="moz-txt-link-abbreviated" href="mailto:forename.surname@company.com">forename.surname@company.com</a>).</p>
Therefore, if I understand correctly, a Subject of the following
type within a "Legacy" SV (Sponsor-Validated) certificate would be
100% compliant:<br>
<p> <a class="moz-txt-link-abbreviated" href="mailto:CN=info@example.com">CN=info@example.com</a>, O=Example HmbH,
organizationIdentifier=NTRXX-xxxxx, C=XX</p>
<p>If this is true, it would make no difference if the certificate
was OV rather than SV: the Subject could be identical in the two
cases, and it would be devoid of "Individual (Natural Person)
attibutes".</p>
<p>Is the above correct, or am I missing something?</p>
<p>Adriano</p>
<p><br>
</p>
</body>
</html>