<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
h2
{mso-style-priority:9;
mso-style-link:"Heading 2 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:18.0pt;
font-family:"Calibri",sans-serif;
color:black;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:13.5pt;
font-family:"Calibri",sans-serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.Heading2Char
{mso-style-name:"Heading 2 Char";
mso-style-priority:9;
mso-style-link:"Heading 2";
font-family:"Calibri",sans-serif;
color:black;
mso-ligatures:none;
font-weight:bold;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Calibri",sans-serif;
color:black;
mso-ligatures:none;
font-weight:bold;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72" style='word-wrap:break-word'><div class=WordSection1><h2><a name="_Hlk116919592">Minutes of SMCWG<o:p></o:p></a></h2><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>November 15, 2023<o:p></o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>These are the </span><span style='mso-bookmark:_Hlk116919592'><span style='color:windowtext'>Approved</span> Minutes of the meeting described in the subject of this message. Corrections and clarifications where needed are encouraged by reply.<o:p></o:p></span></p><h3><span style='mso-bookmark:_Hlk116919592'>Attendees <o:p></o:p></span></h3><h3><span style='mso-bookmark:_Hlk116919592'><span style='font-size:11.0pt;font-weight:normal'>Adrian Mueller - (SwissSign), Andrea Holland - (VikingCloud), Ben Wilson - (Mozilla), Bruce Morton - (Entrust), Chad Ehlers - (IdenTrust), Christophe Bonjean - (GlobalSign), Clint Wilson - (Apple), Corey Bonnell - (DigiCert), Dimitris Zacharopoulos - (HARICA), Doug Beattie - (GlobalSign), Inaba Atsushi - (GlobalSign), Inigo Barreira - (Sectigo), Judith Spencer - (CertiPath), Marco Schambach - (IdenTrust), Martijn Katerbarg - (Sectigo), Miguel Sanchez - (Google), Morad Abou Nasser - (TeleTrust), Paul van Brouwershaven - (Entrust), Rebecca Kelley - (Apple), Robert Lee - (GlobalSign), Russ Housley - (Vigil Security LLC), Scott Rea - (eMudhra), Stefan Selbitschka - (rundQuadrat), Stephen Davidson - (DigiCert), Tadahiko Ito - (SECOM Trust Systems), Wendy Brown - (US Federal PKI Management Authority)<o:p></o:p></span></span></h3><h3><span style='mso-bookmark:_Hlk116919592'>1. Roll Call<o:p></o:p></span></h3><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='mso-bookmark:_Hlk116919592'>The Roll Call was taken.<o:p></o:p></span></p><h3><span style='mso-bookmark:_Hlk116919592'>2. Read Antitrust Statement<o:p></o:p></span></h3><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'><span style='mso-bookmark:_Hlk116919592'>The statement was read concerning the antitrust policy, code of conduct, and intellectual property rights agreement.<o:p></o:p></span></p><h3><span style='mso-bookmark:_Hlk116919592'>3. Review Agenda<o:p></o:p></span></h3><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>Minutes were prepared by Stephen Davidson.<o:p></o:p></span></p><h3><span style='mso-bookmark:_Hlk116919592'>4. Approval of minutes from last teleconference<o:p></o:p></span></h3><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>The minutes for the meeting at the F2F CABF#60 and the teleconference of October 25 were approved.<o:p></o:p></span></p><h3><span style='mso-bookmark:_Hlk116919592'>5. Discussion <o:p></o:p></span></h3><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>Stephen Davidson confirmed that Ballot SMC04 has passed and was now in IP review, ending at 1700 UTC on December 8.<o:p></o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>Stephen walked through the draft text of a ballot to introduce CAA for S/MIME, which may be seen at </span><a href="https://url.avanan.click/v2/___https:/github.com/srdavidson/smime/compare/241e92cde85c25d7e0d4a5c70118ecadacd4d72b...29f73eb50573bf3e04cb417aaf67be1c209f066b___.YXAzOmRpZ2ljZXJ0OmE6bzpjZjAxOGFlOGY5MDFmMzI1ZDdmNGI3MDlkZDFjYWNhMzo2OmFhYzM6YjBmMmMwMGU5NTA0N2ZjNGYwMjM4NDc4ZWU5YWQ2YmQyMDgyOTdlMGMxMjgwNTcyZGY0ODMwOTY4MTM3ZTM1MTpoOkY" title="Protected by Avanan: https://github.com/srdavidson/smime/compare/241e92cde85c25d7e0d4a5c70118ecadacd4d72b...29f73eb50573bf3e04cb417aaf67be1c209f066b"><span style='mso-bookmark:_Hlk116919592'>https://github.com/srdavidson/smime/compare/241e92cde85c25d7e0d4a5c70118ecadacd4d72b...29f73eb50573bf3e04cb417aaf67be1c209f066b</span><span style='mso-bookmark:_Hlk116919592'></span></a><span style='mso-bookmark:_Hlk116919592'>, noting that it drew heavily on the text already found in the TLS BR. Clint Wilson noted that CAA should be applied to all email addresses in the certificate, and that mailbox addresses in the Subject should be repeated in the SAN.<o:p></o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>Stephen noted that he had reached out to KeyFactor (EJBCA) regarding the topic, and strongly encouraged CAs that use commercial software to speak with their respective vendors on the implementation of CAA for S/MIME.<o:p></o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>Stephen outlined the timeline previously discussed in the WG, which would call for a SHOULD after ~6 months and a SHALL after ~12 months (final dates to be determined at the time of ballot). He asked for feedback on the acceptability of those timeframes.<o:p></o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>Stephen then reviewed the issues at </span><a href="https://url.avanan.click/v2/___https:/github.com/cabforum/smime/issues___.YXAzOmRpZ2ljZXJ0OmE6bzpjZjAxOGFlOGY5MDFmMzI1ZDdmNGI3MDlkZDFjYWNhMzo2OjQwZTk6NmFlOGNiNDhmZDAzMzU3OGU0Y2Q5NWM0NWUzZDJiMzJkNDNkY2VlNTFmMjc0NWZjMzc1ZjVhNjg5MTI1NTgwMDpoOkY" title="Protected by Avanan: https://github.com/cabforum/smime/issues"><span style='mso-bookmark:_Hlk116919592'>https://github.com/cabforum/smime/issues</span><span style='mso-bookmark:_Hlk116919592'></span></a><span style='mso-bookmark:_Hlk116919592'> noting those that are already implemented in the draft of a future cleanup ballot which can be found at </span><a href="https://url.avanan.click/v2/___https:/github.com/srdavidson/smime/commits/Ballot-SMC05/SBR.md___.YXAzOmRpZ2ljZXJ0OmE6bzpjZjAxOGFlOGY5MDFmMzI1ZDdmNGI3MDlkZDFjYWNhMzo2OjI5NzU6MjcyMzg1MjY5MTlhNTI4Y2U2NzAzN2QzMDM1ZDFjYWUxZjFkMjRlNzk4YjVlZmY2MjgxOGNmNmFlZjQxYzEwYjpoOkY" title="Protected by Avanan: https://github.com/srdavidson/smime/commits/Ballot-SMC05/SBR.md"><span style='mso-bookmark:_Hlk116919592'>https://github.com/srdavidson/smime/commits/Ballot-SMC05/SBR.md</span><span style='mso-bookmark:_Hlk116919592'></span></a><span style='mso-bookmark:_Hlk116919592'>.<o:p></o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>Stephen noted several new issues filed by Rob Lee and suggested to WG members that this was a good place to file questions that may be raised in the course of operating under the SBR.<o:p></o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>The WG discussed the revocation backdating topic seen at </span><a href="https://url.avanan.click/v2/___https:/github.com/cabforum/smime/issues/221___.YXAzOmRpZ2ljZXJ0OmE6bzpjZjAxOGFlOGY5MDFmMzI1ZDdmNGI3MDlkZDFjYWNhMzo2OjVjZDU6NzFkMDUyZDcwYTQzMDQwMTZhNzk0OTJiNzkwYzg5YWNhMWJhMjVlZDA2MWM4NmE4Nzg1MjRiNzU1YzZkYWJjYjpoOkY" title="Protected by Avanan: https://github.com/cabforum/smime/issues/221"><span style='mso-bookmark:_Hlk116919592'>https://github.com/cabforum/smime/issues/221</span><span style='mso-bookmark:_Hlk116919592'></span></a><span style='mso-bookmark:_Hlk116919592'>. It was agreed to park the topic for now given the doubts that backdating had a use in the S/MIME protocol as it stands. Stephen said the WG would return to the topic in future if it simplified implementations for CA operators. <o:p></o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>The WG discussed the topic of the SV Legacy Subject which had arisen in several teleconferences; Stephen noted that the group would return to it in December. One consideration was whether to tweak the Legacy profile, or to focus on the date upon which the Legacy profiles might be reasonably retired. Stephen again asked CAs to consider if there were elements missing from the Multipurpose or Strict profiles that might complicate this migration.<o:p></o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'><o:p> </o:p></span></p><h3 style='mso-margin-top-alt:1.0pt;margin-right:0in;margin-bottom:1.0pt;margin-left:0in'><span style='mso-bookmark:_Hlk116919592'>6. Any Other Business<o:p></o:p></span></h3><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'><o:p> </o:p></span></p><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>None<o:p></o:p></span></p><h3><span style='mso-bookmark:_Hlk116919592'>7. Next call<o:p></o:p></span></h3><p class=MsoNormal><span style='mso-bookmark:_Hlk116919592'>Next call: Wednesday, December 6, 2023 at 11:00 am Eastern Time<o:p></o:p></span></p><h3><span style='mso-bookmark:_Hlk116919592'><span lang=DE>Adjourned</span></span><span style='mso-bookmark:_Hlk116919592'></span><o:p></o:p></h3><p class=MsoNormal><span style='color:windowtext'><o:p> </o:p></span></p></div></body></html>