<div dir="ltr">I am no lawyer and not speaking on behalf of any CA, so the following is just my personal opinion, but I think the continued use of a corporate name after acquisition by another company may possibly vary based on country.<div><br></div><div>I say that based solely on anecdotal information having worked for several companies in the past that were acquired by other companies and yet continued to use the former name for some time for DNS, emails and other purposes in order to fulfill prior contractual obligations.</div><div>Another example might be a company that has an OID arc for protocol extensions or certificate policies that may be asserted in certificates that did not expire just because the company was acquired. The new owner retained the right to continue using those OiDs.</div><div><br></div><div>Thanks,<br clear="all"><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><p class="MsoNormal"><span style="font-family:"Segoe Script",sans-serif">Wendy</span></p><p class="MsoNormal"><br></p><p class="MsoNormal">Wendy Brown</p>
<p class="MsoNormal">Protiviti Government
Services<br></p>
<br></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Jan 10, 2024 at 2:41 AM Adriano Santoni via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org">smcwg-public@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>
<div>
<p><font face="Calibri">Thank you, Maria, for sharing your opinion.</font></p>
<p><font face="Calibri">I'd love to hear from others as well....</font></p>
<p><font face="Calibri">Adriano</font></p>
<p><font face="Calibri"><br>
</font></p>
<div>Il 09/01/2024 17:54, Maria Merkel ha
scritto:<br>
</div>
<blockquote type="cite">
<div align="center">
<table width="30%" cellspacing="2" cellpadding="2" border="1">
<tbody>
<tr>
<td valign="top" bgcolor="#ffff00"> <span style="color:red">NOTICE:</span> Pay attention -
external email - Sender is <a href="mailto:maria@maria.cc" target="_blank">maria@maria.cc</a> </td>
</tr>
</tbody>
</table>
<br>
</div>
<br>
<div dir="ltr">
<div dir="ltr">Hello Adriano,
<div><br>
</div>
<div>I'm not sure whether I have posting permissions for this
list, but I will try anyway.</div>
<div><br>
</div>
<div>I do believe this is a wider issue than just one for
S/MIME. I
had recently noticed that a CA had issued a TLS server
certificate
to a company that no longer exists (as the company had
merged into
a new company, and the legal entity in the certificate has
been
dissolved as a result). I had reported this to the CA, who
have
decided not to revoke the certificate (and have, in fact,
issued at
least one further certificate to the company), despite me
having shared government-provided evidence of the company
having
been dissolved, because they were able to verify the name
via a
"reliable source" (presumably D&B or Google).</div>
<div><br>
</div>
<div>I have looked into this further at the time and it seems
like
this is currently perfectly compliant with the BR, but
surely
adding a rule prohibiting CAs from including information
they know
to be incorrect, even if it is "verifiable", would make
sense?</div>
<div><br>
</div>
<div>Regarding companies in liquidation, I am not sure these
should
be prohibited from obtaining certificates. Companies in
liquidation
may continue to operate for a significant amount of time
under
management of their liquidator, and it doesn't seem unlikely
that for some companies it may be required (or at least
desired) to
obtain certificates during that time.</div>
<div><br>
</div>
<div>Maria Merkel</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, Jan 9, 2024 at
5:44 PM
Adriano Santoni via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org" target="_blank">smcwg-public@cabforum.org</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<p>Hello all,</p>
Authentication of organization identity involves the
collection of
some attributes and their validation. To collect these
attributes,
a CA typically queries a reliable third-party source, e.g.
the
business register of the relevant country. Among the
attributes
that can be found in these sources there is normally also
the
<i>operational status</i> of the company, such as e.g.
ACTIVE or
CEASED.<br>
<p>To me, it seems logical that a certificate should not
be issued
to a ceased company, but this is not specified in the
SMBR. I
believe we should specify it. </p>
<p>In the current SMBR, the entity status is required to
be ACTIVE
only in the particular case of inserting an LEI
reference in the
certificate (which is not mandatory), but not in the
more general
case. Perhaps an oversight? </p>
<p>A company that has gone out of business (e.g. in
liquidation)
may still "exist" in a certain way for some time (you
can
still check any other data regarding it, in the company
registry),
but it is still a defunct company to which in my
opinion, a
certificate should not be issued. I can imagine that
someone will
have a different opinion and say that there is no
problem in
issuing a certificate to a company in liquidation. But
then, I see
no reason why we require the entity status to be ACTIVE
"If an
LEI data reference is used".<br>
</p>
<p>I therefore propose to include a clarification in the
SMBRs
(possibly in section 3.2.3.1) that the operational
status of the
company is one of the attributes to be collected, and
that it must
be ACTIVE (or the equivalent according to the
terminology of the
relevant country), regardless of whether a LEI reference
is used or
not in the certificate.<br>
</p>
<p>Adriano<br>
</p>
<p>PS: In my opinion, this also affects the BRs and the
CSBRs.<br>
</p>
<br>
</div>
_______________________________________________<br>
Smcwg-public mailing list<br>
<a href="mailto:Smcwg-public@cabforum.org" target="_blank">Smcwg-public@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a><br>
</blockquote>
</div>
</div>
</blockquote>
</div>
_______________________________________________<br>
Smcwg-public mailing list<br>
<a href="mailto:Smcwg-public@cabforum.org" target="_blank">Smcwg-public@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a><br>
</blockquote></div>