<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Segoe Script";
panose-1:3 11 5 4 2 0 0 0 0 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Am forwarding the message from a list subscriber who is not a member of the WG, but whose comments are relevant to our discussions today.<o:p></o:p></p>
<p class="MsoNormal">Regards, Stephen<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Maria Merkel <maria@maria.cc> <br>
<b>Sent:</b> Wednesday, January 10, 2024 9:38 AM<br>
<b>To:</b> Wendy Brown - QT3LB-C <wendy.brown@gsa.gov><br>
<b>Cc:</b> Adriano Santoni <adriano.santoni@staff.aruba.it>; SMIME Certificate Working Group <smcwg-public@cabforum.org><br>
<b>Subject:</b> Re: [Smcwg-public] [External Sender] Re: Forbid issuance of certificates to ceased organizations<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Of course I am not claiming to understand every jurisdiction in the world, but I believe that in most of them there are two things to differentiate here:<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>1. Mergers in the corporate law sense and acquisitions (even if both are commonly called mergers)</b><br>
In case of an acquisition, both companies continue to exist. In case of a merger, the business of one company is transferred to a new company, and the old company is dissolved. Only the new company (the merger target) exists after the merger is complete.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">From a CA (and general outside) perspective, nothing has changed with an acquisition. The same company still exists, it only has a new owner. With mergers it becomes a bit more complicated:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>2. Legal names, registered business names and unregistered business names</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Companies usually have a single legal name under which they are registered. This is the name
<i>usually</i> included in a certificate. A legal name is tied to the specific company and, in virtually all jurisdictions, cannot be used once the company is dissolved, even if this is due to a merger (unless, of course, a new company is registered under that
name or the merger target company changes its name to the legal name of the old company).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Additionally, many companies have one or more separate business names under which they are known to the public. Depending on the jurisdiction, those may or may not be registered with the government, or whether to register them may be at
the company's discretion. The S/MIME BR allow <i>registered</i> business names to be included in a certificate, but not unregistered ones. A business name (regardless of whether it is registered or not) can and usually will be taken over in a merger, at least
temporarily.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><b>General Thoughts</b><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">While this knowledge may be useful to understand the backgrounds, I don't think this matters too much from a CA perspective, and too much of it is jurisdiction-specific for it to be feasible to make specific rules for each situation (nor
may this be desirable due to the complexity).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I think the reasonable thing to do would be what <a href="mailto:adriano.santoni@staff.aruba.it" target="_blank">@Adriano Santoni</a> originally suggested, specifically requiring that a company is "active" per its home jurisdiction (which
is usually reflected on that jusrisdiction's website, and datasets like LEI data). This would be valuable because there doesn't seem a practical situation in which a company that no longer exists could do anything (including using a certificate), so at best
such an entry would always be misleading. There is value in a person relying on a certificate being able to identify the specific legal entity on behalf of whom a message was sent, as this will be relevant in case of legal disputes. There may also be additional
legal considerations, such as not being able to hold a dissolved company accountable for breaches of subscriber agreements, but this is more of a consideration for each CA rather than something that would likely matter to the public at large.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">It may be worth noting that not all jurisdictions make the status (like "active") of a company publicly available, especially not free of charge. Therefore perhaps including the legal name of a company whose status is unknown should also
be allowed, as long as the CA does not have a reason to believe that the status is not "active".<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Maria Merkel<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Jan 10, 2024 at 2:03 PM Wendy Brown - QT3LB-C <<a href="mailto:wendy.brown@gsa.gov" target="_blank">wendy.brown@gsa.gov</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p class="MsoNormal">I am no lawyer and not speaking on behalf of any CA, so the following is just my personal opinion, but I think the continued use of a corporate name after acquisition by another company may possibly vary based on country.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I say that based solely on anecdotal information having worked for several companies in the past that were acquired by other companies and yet continued to use the former name for some time for DNS, emails and other purposes in order to
fulfill prior contractual obligations.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Another example might be a company that has an OID arc for protocol extensions or certificate policies that may be asserted in certificates that did not expire just because the company was acquired. The new owner retained the right to
continue using those OiDs.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<br clear="all">
<o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-family:"Segoe Script"">Wendy</span><o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><o:p> </o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Wendy Brown<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Protiviti Government Services<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Jan 10, 2024 at 2:41 AM Adriano Santoni via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org" target="_blank">smcwg-public@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p>Thank you, Maria, for sharing your opinion.<o:p></o:p></p>
<p>I'd love to hear from others as well....<o:p></o:p></p>
<p>Adriano<o:p></o:p></p>
<p><o:p> </o:p></p>
<div>
<p class="MsoNormal">Il 09/01/2024 17:54, Maria Merkel ha scritto:<o:p></o:p></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div align="center">
<table class="MsoNormalTable" border="1" cellpadding="0" width="30%" style="width:30.0%">
<tbody>
<tr>
<td valign="top" style="background:yellow;padding:1.5pt 1.5pt 1.5pt 1.5pt">
<p class="MsoNormal"><span style="color:red">NOTICE:</span><span style="color:black"> Pay attention - external email - Sender is
<a href="mailto:maria@maria.cc" target="_blank">maria@maria.cc</a> </span><o:p></o:p></p>
</td>
</tr>
</tbody>
</table>
</div>
<p class="MsoNormal" align="center" style="text-align:center"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hello Adriano, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm not sure whether I have posting permissions for this list, but I will try anyway.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I do believe this is a wider issue than just one for S/MIME. I had recently noticed that a CA had issued a TLS server certificate to a company that no longer exists (as the company had merged into a new company, and the legal entity in
the certificate has been dissolved as a result). I had reported this to the CA, who have decided not to revoke the certificate (and have, in fact, issued at least one further certificate to the company), despite me having shared government-provided evidence
of the company having been dissolved, because they were able to verify the name via a "reliable source" (presumably D&B or Google).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I have looked into this further at the time and it seems like this is currently perfectly compliant with the BR, but surely adding a rule prohibiting CAs from including information they know to be incorrect, even if it is "verifiable",
would make sense?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Regarding companies in liquidation, I am not sure these should be prohibited from obtaining certificates. Companies in liquidation may continue to operate for a significant amount of time under management of their liquidator, and it doesn't
seem unlikely that for some companies it may be required (or at least desired) to obtain certificates during that time.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Maria Merkel<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, Jan 9, 2024 at 5:44 PM Adriano Santoni via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org" target="_blank">smcwg-public@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<p>Hello all,<o:p></o:p></p>
<p class="MsoNormal">Authentication of organization identity involves the collection of some attributes and their validation. To collect these attributes, a CA typically queries a reliable third-party source, e.g. the business register of the relevant country.
Among the attributes that can be found in these sources there is normally also the
<i>operational status</i> of the company, such as e.g. ACTIVE or CEASED.<o:p></o:p></p>
<p>To me, it seems logical that a certificate should not be issued to a ceased company, but this is not specified in the SMBR. I believe we should specify it. <o:p></o:p></p>
<p>In the current SMBR, the entity status is required to be ACTIVE only in the particular case of inserting an LEI reference in the certificate (which is not mandatory), but not in the more general case. Perhaps an oversight? <o:p></o:p></p>
<p>A company that has gone out of business (e.g. in liquidation) may still "exist" in a certain way for some time (you can still check any other data regarding it, in the company registry), but it is still a defunct company to which in my opinion, a certificate
should not be issued. I can imagine that someone will have a different opinion and say that there is no problem in issuing a certificate to a company in liquidation. But then, I see no reason why we require the entity status to be ACTIVE "If an LEI data reference
is used".<o:p></o:p></p>
<p>I therefore propose to include a clarification in the SMBRs (possibly in section 3.2.3.1) that the operational status of the company is one of the attributes to be collected, and that it must be ACTIVE (or the equivalent according to the terminology of the
relevant country), regardless of whether a LEI reference is used or not in the certificate.<o:p></o:p></p>
<p>Adriano<o:p></o:p></p>
<p>PS: In my opinion, this also affects the BRs and the CSBRs.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal">_______________________________________________<br>
Smcwg-public mailing list<br>
<a href="mailto:Smcwg-public@cabforum.org" target="_blank">Smcwg-public@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" target="_blank">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal">_______________________________________________<br>
Smcwg-public mailing list<br>
<a href="mailto:Smcwg-public@cabforum.org" target="_blank">Smcwg-public@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" target="_blank">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a><o:p></o:p></p>
</blockquote>
</div>
</blockquote>
</div>
</div>
</body>
</html>