<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><span style="font-family: -webkit-standard; font-size: medium;">I think the text should require such extension to be non-critical.</span><div><font face="-webkit-standard" size="3"><br></font></div><div><font face="-webkit-standard" size="3">Russ<br></font><div><br><blockquote type="cite"><div>On Feb 12, 2024, at 5:54 AM, Martijn Katerbarg via Smcwg-public <smcwg-public@cabforum.org> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Thanks all. Proposed language is in<span class="Apple-converted-space"> </span></span><span lang="SV" style="font-size: 11pt;"><a href="https://github.com/srdavidson/smime/pull/10" style="color: blue; text-decoration: underline;"><span lang="EN-US">https://github.com/srdavidson/smime/pull/10</span></a></span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"><o:p> </o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span style="font-size: 11pt;"><o:p> </o:p></span></div><div id="mail-editor-reference-message-container"><div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; border-image: none; padding: 3pt 0cm 0cm;"><p class="MsoNormal" style="margin: 0cm 0cm 12pt; font-size: 10pt; font-family: Calibri, sans-serif;"><b><span lang="EN-US" style="font-size: 12pt; font-family: Aptos, sans-serif;">From:<span class="Apple-converted-space"> </span></span></b><span lang="EN-US" style="font-size: 12pt; font-family: Aptos, sans-serif;">Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com" style="color: blue; text-decoration: underline;">tim.hollebeek@digicert.com</a>><br><b>Date:<span class="Apple-converted-space"> </span></b>Wednesday, 17 January 2024 at 22:01<br><b>To:<span class="Apple-converted-space"> </span></b>Clint Wilson <<a href="mailto:clintw@apple.com" style="color: blue; text-decoration: underline;">clintw@apple.com</a>>, Martijn Katerbarg <<a href="mailto:martijn.katerbarg@sectigo.com" style="color: blue; text-decoration: underline;">martijn.katerbarg@sectigo.com</a>>, SMIME Certificate Working Group <<a href="mailto:smcwg-public@cabforum.org" style="color: blue; text-decoration: underline;">smcwg-public@cabforum.org</a>><br><b>Cc:<span class="Apple-converted-space"> </span></b>Dimitris Zacharopoulos <<a href="mailto:dzacharo@harica.gr" style="color: blue; text-decoration: underline;">dzacharo@harica.gr</a>><br><b>Subject:<span class="Apple-converted-space"> </span></b>RE: [Smcwg-public] Certificate Template Information extension and SBR allowance<o:p></o:p></span></p></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Yep. If you use a SDO OID, you MUST use it in compliance with all the associated restrictions in the relevant standard.<o:p></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Otherwise you’re using the OID for something else entirely, which you do not have the “right” to do.<o:p></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">You cannot claim that you have the “right” to use the CABF OrgID extension to identify a cheeseburger in order to allow customers to put cheeseburgers in certificates. If you’re using an extension, you need to use it in the intended way.<o:p></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Using extensions in non-standard ways eventually renders them useless and gets them banned (see: Organizational Unit).<o:p></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">-Tim<o:p></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div><div style="border-width: medium medium medium 1.5pt; border-style: none none none solid; border-color: currentcolor currentcolor currentcolor blue; border-image: none; padding: 0cm 0cm 0cm 4pt;"><div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor; border-image: none; padding: 3pt 0cm 0cm;"><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><b><span lang="EN-US" style="font-size: 11pt;">From:</span></b><span lang="EN-US" style="font-size: 11pt;"><span class="Apple-converted-space"> </span>Clint Wilson <<a href="mailto:clintw@apple.com" style="color: blue; text-decoration: underline;">clintw@apple.com</a>><span class="Apple-converted-space"> </span><br><b>Sent:</b><span class="Apple-converted-space"> </span>Tuesday, January 16, 2024 3:19 PM<br><b>To:</b><span class="Apple-converted-space"> </span>Martijn Katerbarg <<a href="mailto:martijn.katerbarg@sectigo.com" style="color: blue; text-decoration: underline;">martijn.katerbarg@sectigo.com</a>>; SMIME Certificate Working Group <<a href="mailto:smcwg-public@cabforum.org" style="color: blue; text-decoration: underline;">smcwg-public@cabforum.org</a>><br><b>Cc:</b><span class="Apple-converted-space"> </span>Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com" style="color: blue; text-decoration: underline;">tim.hollebeek@digicert.com</a>>; Dimitris Zacharopoulos <<a href="mailto:dzacharo@harica.gr" style="color: blue; text-decoration: underline;">dzacharo@harica.gr</a>><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Smcwg-public] Certificate Template Information extension and SBR allowance<o:p></o:p></span></div></div></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">While I think I agree with the intent of Tim’s statement (especially in the context of this discussion and its applicability thereto), taken literally I believe it is stating something with broader impact than intended. <o:p></o:p></span></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">What I mean is that it’s important to carry the complete context of an OID over, including the requirements and/or prerequisites outlined for the use of an OID (to the extent specified or stipulated by the governing SDO). The “right” exists, but so to do obligations coinciding with the use of many (all?) OIDs. I believe everyone here’s suitably aware of this, but just wanted to state it explicitly so that too much nuance isn’t lost with any potential changes made to the text.<o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Cheers,<o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">-Clint<o:p></o:p></span></div><div><p class="MsoNormal" style="margin: 0cm 0cm 12pt; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"><o:p> </o:p></span></p><blockquote style="margin-top: 5pt; margin-bottom: 5pt;"><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">On Jan 16, 2024, at 11:27 AM, Martijn Katerbarg via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org" style="color: blue; text-decoration: underline;">smcwg-public@cabforum.org</a>> wrote:<o:p></o:p></span></div></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div><div><div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">> Absolutely. Any OID that comes from a Standards Development Organization is intended for use by other organizations, and everyone has the “right” to use them.<o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">I’d like to be able to read it this way, but I am concerned that the current language is too limiting in this regard.<o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Tim, since you also mentioned not liking the language, I’ll see if I can come up with an alternative to make this clear, and also make the implied allowance a stated fact.<o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Regards,<o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Martijn<o:p></o:p></span></div></div><div id="ms-outlook-mobile-signature"><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div></div><div id="mail-editor-reference-message-container"><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div><div class="MsoNormal" align="center" style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif; text-align: center;"><span lang="EN-US" style="font-size: 11pt;"><hr size="0" width="100%" align="center"></span></div><div id="divRplyFwdMsg"><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><strong><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif;">From:</span></strong><span lang="EN-US" style="font-size: 11pt;"><span class="Apple-converted-space"> </span>Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com" style="color: blue; text-decoration: underline;">tim.hollebeek@digicert.com</a>><br><strong><span style="font-family: Calibri, sans-serif;">Sent:</span></strong><span class="Apple-converted-space"> </span>Wednesday, January 10, 2024 10:58:58 pm<br><strong><span style="font-family: Calibri, sans-serif;">To:</span></strong><span class="Apple-converted-space"> </span>Dimitris Zacharopoulos <<a href="mailto:dzacharo@harica.gr" style="color: blue; text-decoration: underline;">dzacharo@harica.gr</a>>; SMIME Certificate Working Group <<a href="mailto:smcwg-public@cabforum.org" style="color: blue; text-decoration: underline;">smcwg-public@cabforum.org</a>><br><strong><span style="font-family: Calibri, sans-serif;">Cc:</span></strong><span class="Apple-converted-space"> </span>Martijn Katerbarg <<a href="mailto:martijn.katerbarg@sectigo.com" style="color: blue; text-decoration: underline;">martijn.katerbarg@sectigo.com</a>><br><strong><span style="font-family: Calibri, sans-serif;">Subject:</span></strong><span class="Apple-converted-space"> </span>RE: [Smcwg-public] Certificate Template Information extension and SBR allowance<o:p></o:p></span></div></div><p class="MsoNormal" style="margin: 0cm 0cm 12pt; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"><o:p> </o:p></span></p><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Absolutely. Any OID that comes from a Standards Development Organization is intended for use by other organizations, and everyone has the “right” to use them.<o:p></o:p></span></div></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">-Tim<o:p></o:p></span></div></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div><div style="border-width: medium medium medium 1.5pt; border-style: none none none solid; border-color: currentcolor currentcolor currentcolor blue; border-image: none; padding: 0cm 0cm 0cm 4pt;"><div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor; border-image: none; padding: 3pt 0cm 0cm;"><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><b><span lang="EN-US" style="font-size: 11pt;">From:</span></b><span lang="EN-US" style="font-size: 11pt;"><span class="Apple-converted-space"> </span>Dimitris Zacharopoulos <<a href="mailto:dzacharo@harica.gr" style="color: blue; text-decoration: underline;">dzacharo@harica.gr</a>><span class="Apple-converted-space"> </span><br><b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, January 10, 2024 12:48 PM<br><b>To:</b><span class="Apple-converted-space"> </span>Tim Hollebeek <<a href="mailto:tim.hollebeek@digicert.com" style="color: blue; text-decoration: underline;">tim.hollebeek@digicert.com</a>>; SMIME Certificate Working Group <<a href="mailto:smcwg-public@cabforum.org" style="color: blue; text-decoration: underline;">smcwg-public@cabforum.org</a>><br><b>Cc:</b><span class="Apple-converted-space"> </span>Martijn Katerbarg <<a href="mailto:martijn.katerbarg@sectigo.com" style="color: blue; text-decoration: underline;">martijn.katerbarg@sectigo.com</a>><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [Smcwg-public] Certificate Template Information extension and SBR allowance<o:p></o:p></span></div></div></div></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div><div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt; font-family: Arial, sans-serif;">I also believe that any publicly supported and documented X.509 extension (e.g. defined by IETF or ITU-T) are allowed for use by CAs, as long as they are documented in the CA's CPS.<span class="Apple-converted-space"> </span><br><br>Is there anything that prevents it in the current CA/B Forum documents?<span class="Apple-converted-space"> </span><br><br><br>Thanks,<span class="Apple-converted-space"> </span></span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div></div><div><p><span lang="EN-US" style="font-family: Arial, sans-serif;">DZ.</span><span lang="EN-US"><o:p></o:p></span></p></div><div><div><p><span lang="EN-US" style="font-family: Arial, sans-serif;">Jan 10, 2024 20:38:19 Tim Hollebeek via Smcwg-public <<a href="mailto:smcwg-public@cabforum.org" style="color: blue; text-decoration: underline;">smcwg-public@cabforum.org</a>>:</span><span lang="EN-US"><o:p></o:p></span></p></div><blockquote style="border-width: medium medium medium 2.25pt; border-style: none none none solid; border-color: currentcolor currentcolor currentcolor rgb(204, 204, 204); border-image: none; padding: 0cm 0cm 0cm 8pt; margin: 5pt 0cm;"><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">You don’t need a contract to have a right to use someone else’s extension.</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">I would say that if Microsoft has public documentation that says or implies that the extension can and should be used by other organizations, then other organizations “have the right” to use that extension.</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">That said, I have never liked this language, which comes from the TLS BRs. I would support making it more clear as to what is and isn’t allowed, and even maybe clarifying what problem is being solved with these requirements.</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">-Tim</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div style="border-width: medium medium medium 1.5pt; border-style: none none none solid; border-color: currentcolor currentcolor currentcolor blue; border-image: none; padding: 0cm 0cm 0cm 4pt;"><div><div style="border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor; border-image: none; padding: 3pt 0cm 0cm;"><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><b><span lang="EN-US" style="font-size: 11pt;">From:</span></b><span lang="EN-US" style="font-size: 11pt;"><span class="Apple-converted-space"> </span>Smcwg-public <<a href="mailto:smcwg-public-bounces@cabforum.org" style="color: blue; text-decoration: underline;">smcwg-public-bounces@cabforum.org</a>><span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Martijn Katerbarg via Smcwg-public<br><b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, January 10, 2024 5:54 AM<br><b>To:</b><span class="Apple-converted-space"> </span>SMIME Certificate Working Group <<a href="mailto:smcwg-public@cabforum.org" style="color: blue; text-decoration: underline;">smcwg-public@cabforum.org</a>><br><b>Subject:</b><span class="Apple-converted-space"> </span>[Smcwg-public] Certificate Template Information extension and SBR allowance<o:p></o:p></span></div></div></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="SV" style="font-size: 11pt;">Hi all,</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">There’s been a request within the S/MIME working group to bring forward issues that have arisen since the adoption of the SBRs. While we’ve not seen a whole lot of issues, we believe we may have discovered one now.</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">We offer support for Windows’s own auto-enrollment features. In the past we used to include the “Certificate Template Information” extension (OID 1.3.6.1.4.1.311.21.7) for this purpose. Since we started issuing SBR compliant certificates prior to September 1<sup>st</sup>, we removed support for this extension on publicly trusted S/MIME certificates.</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">As we now have noticed, this has led to a partial breakdown of the auto-enrollment system. From what we understand, the auto-enrollment mechanism is specifically looking for this extension in certificates, if a certificate for a particular required Certificate Template (as specified through AD) is not found, auto-enrollment will “do its job”, and request a new certificate. This can lead to multiple new certificates being installed in a single day, all because the extension is missing.</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">We’ve investigated bringing back support for the extension, and are led to the conclusion that no, this extension would not be allowed per the current language. A breakdown:</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Section 7.1.2.4 (<a href="https://url.avanan.click/v2/___https:/github.com/cabforum/smime/blob/main/SBR.md%237124-all-certificates___.YXAzOmRpZ2ljZXJ0OmE6bzphYmIxNjU3ZGU1ZTYwODNjM2Q3N2NjOTI2NDlhNTFhNzo2Ojk4ZDE6N2VhYmQyYzcxNDdhYjlhZDExZmE0MDI3ZWVmYzEyNDY0YzM5YjI1Yzc0NjEzZmUwZTU2MGJjMzhiM2QxMWRjMDpoOkY" title="Protected by Avanan: https://github.com/cabforum/smime/blob/main/SBR.md#7124-all-certificates" style="color: blue; text-decoration: underline;">https://github.com/cabforum/smime/blob/main/SBR.md#7124-all-certificates</a><span class="Apple-converted-space"> </span>) states:</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><i><span lang="EN-US" style="font-size: 11pt;">“All fields and extensions SHALL be set in accordance with<span class="Apple-converted-space"> </span><a href="https://url.avanan.click/v2/___https:/datatracker.ietf.org/doc/html/rfc5280___.YXAzOmRpZ2ljZXJ0OmE6bzphYmIxNjU3ZGU1ZTYwODNjM2Q3N2NjOTI2NDlhNTFhNzo2OmIzZWM6YWE0NTVlYmI4ZDk2OWMwMzJkZmQ1NzM5YzE3YzAwOGUyOGFiYWE2ZTMyNDA4YWY4YTc2MzQyZWVlNDNlMjIzNTpoOkY" title="Protected by Avanan: https://datatracker.ietf.org/doc/html/rfc5280" style="color: blue; text-decoration: underline;">RFC 5280</a>. The CA SHALL NOT issue a Certificate that contains a<span class="Apple-converted-space"> </span></span></i><code style="font-family: "Courier New";"><i><span lang="EN-US">keyUsage</span></i></code><i><span lang="EN-US" style="font-size: 11pt;"><span class="Apple-converted-space"> </span>flag,<span class="Apple-converted-space"> </span></span></i><code style="font-family: "Courier New";"><i><span lang="EN-US">extKeyUsage</span></i></code><i><span lang="EN-US" style="font-size: 11pt;"><span class="Apple-converted-space"> </span>value, Certificate extension, or other data not specified in<span class="Apple-converted-space"> </span><a href="https://url.avanan.click/v2/___https:/github.com/cabforum/smime/blob/main/SBR.md%237121-root-ca-certificates___.YXAzOmRpZ2ljZXJ0OmE6bzphYmIxNjU3ZGU1ZTYwODNjM2Q3N2NjOTI2NDlhNTFhNzo2OmZjMDg6MzYxZGEyOGIzOWI5YmEzY2Y4MjRiOTczYzlkZGMzYmIyNTk4YWU4ZjRkNTRhNzdmNGNlNGI4Y2E3MGZhOGVjZDpoOkY" title="Protected by Avanan: https://github.com/cabforum/smime/blob/main/SBR.md#7121-root-ca-certificates" style="color: blue; text-decoration: underline;">Section 7.1.2.1</a>,<span class="Apple-converted-space"> </span><a href="https://url.avanan.click/v2/___https:/github.com/cabforum/smime/blob/main/SBR.md%237122-subordinate-ca-certificates___.YXAzOmRpZ2ljZXJ0OmE6bzphYmIxNjU3ZGU1ZTYwODNjM2Q3N2NjOTI2NDlhNTFhNzo2OmU0MTg6MzE4Mzc4YTg4NThmMzMxOWY3Yjk3OGM1MmMyNzgzNTNkYzRiMmRiNTg4NWM0YmFlOTQ4MDAyZTMxZWQyYWY0NzpoOkY" title="Protected by Avanan: https://github.com/cabforum/smime/blob/main/SBR.md#7122-subordinate-ca-certificates" style="color: blue; text-decoration: underline;">Section 7.1.2.2</a>, or<span class="Apple-converted-space"> </span><a href="https://url.avanan.click/v2/___https:/github.com/cabforum/smime/blob/main/SBR.md%237123-subscriber-certificates___.YXAzOmRpZ2ljZXJ0OmE6bzphYmIxNjU3ZGU1ZTYwODNjM2Q3N2NjOTI2NDlhNTFhNzo2OmRmM2E6ZDE5OTU5Yjg2ODJhYmVkOGZhYjUzMDcwNGY3MDNiZTQ2ZTQ3YTkxMWQ1NjE0OGMxOTJmNjQwYmIxNTI0ZDAwZjpoOkY" title="Protected by Avanan: https://github.com/cabforum/smime/blob/main/SBR.md#7123-subscriber-certificates" style="color: blue; text-decoration: underline;">Section 7.1.2.3</a><span class="Apple-converted-space"> </span>unless the CA is aware of a reason for including the data in the Certificate. If the CA includes fields or extensions in a Certificate that are not specified but are otherwise permitted by these Requirements, then the CA SHALL document the processes and procedures that the CA employs for the validation of information contained in such fields and extensions in its CP and/or CPS.”</span></i><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">So far, we could see allowing the extension. We have “a reason for including the data in the Certificate”, and we could update our CPS. However, the language continues with an additional SHALL NOT:</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><p><i><span lang="EN-US">“CAs SHALL NOT issue a Certificate with:</span></i><span lang="EN-US"><o:p></o:p></span></p><ol start="1" type="1" style="margin-bottom: 0cm;"><li class="MsoNormal" style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><i><span lang="EN-US" style="font-size: 11pt;">Extensions that do not apply in the context of the public Internet (such as an<span class="Apple-converted-space"> </span></span></i><i><span lang="EN-US" style="font-family: "Courier New";">extKeyUsage</span></i><i><span lang="EN-US" style="font-size: 11pt;"><span class="Apple-converted-space"> </span>value for a service that is only valid in the context of a privately managed network), unless:<br>i. such value falls within an OID arc for which the Applicant demonstrates ownership, or<br>ii. the Applicant can otherwise demonstrate the right to assert the data in a public context; or</span></i><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></li><li class="MsoNormal" style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><i><span lang="EN-US" style="font-size: 11pt;">Field or extension values which have not been validated according to the processes and procedures described in these Requirements or the CA's CP and/or CPS.</span></i><span lang="EN-US" style="font-size: 11pt;">”</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></li></ol><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">So while the first section might allow us to incorporate the extension, it seems we also need to meet one of the statements in this block:</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">“</span><i><span lang="EN-US" style="font-size: 11pt;">Extensions that do not apply in the context of the public Internet (such as an<span class="Apple-converted-space"> </span></span></i><i><span lang="EN-US" style="font-family: "Courier New";">extKeyUsage</span></i><i><span lang="EN-US" style="font-size: 11pt;"><span class="Apple-converted-space"> </span>value for a service that is only valid in the context of a privately managed network), unless:”<br></span></i><span lang="EN-US" style="font-size: 11pt;">This extension indeed does not apply in the context of the public Internet. So, we move into the exception cases:<o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><i><span lang="EN-US" style="font-size: 11pt;">”i. such value falls within an OID arc for which the Applicant demonstrates ownership, or”<br></span></i><span lang="EN-US" style="font-size: 11pt;">No. Neither us, nor the Applicant owns the OID. It’s an OID under the Microsoft OID arc.<o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">”<i><span class="Apple-converted-space"> </span>ii. the Applicant can otherwise demonstrate the right to assert the data in a public context; or”<br></i>Unless the Applicant gets a contract stating they were given the right by Microsoft, we don’t see how this requirement is met.<span class="Apple-converted-space"> </span><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Then we’re left with “<i><span>Field or extension values which have not been validated according to the processes and procedures described in these Requirements or the CA's CP and/or CPS.”<br></span></i><span>This one is a bit odd. Does this suddenly suggest or imply that the CA may include any field or extension that has been validated according only to the CA’s CP and/or CPS? Item “(ii)” ends with an “or”. However, we believe this is an incorrect editorial bit that should be updated, since the list shifts back to a previous indentation.</span><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">All in all, we’re left with the understanding that, no, this extension is not allowed (with the exception that if Microsoft were to be the Applicant, it would be allowed).</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">With this breakdown, we’re left with a few questions:</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div><ol start="1" type="1" style="margin-bottom: 0cm;"><li class="MsoListParagraph" style="margin-right: 0cm; margin-left: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Have other CAs run into the same issue?</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-right: 0cm; margin-left: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Do other CAs share the same conclusion?</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-right: 0cm; margin-left: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">If this does appear to be an issue, should an extension by the platform of one of our Certificate Consumers, be specifically added as an allowed extension?</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></li></ol><div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">Regards,<br><br>Martijn<br>Sectigo</span><span lang="EN-US" style="font-size: 11pt;"><o:p></o:p></span></div></div></div></blockquote></div></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;">_______________________________________________<br>Smcwg-public mailing list<br><a href="mailto:Smcwg-public@cabforum.org" style="color: blue; text-decoration: underline;">Smcwg-public@cabforum.org</a><br><a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" style="color: blue; text-decoration: underline;">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a><o:p></o:p></span></div></div></blockquote></div><div style="margin: 0cm; font-size: 10pt; font-family: Calibri, sans-serif;"><span lang="EN-US" style="font-size: 11pt;"> <o:p></o:p></span></div></div></div></div></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">_______________________________________________</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Smcwg-public mailing list</span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="mailto:Smcwg-public@cabforum.org" style="color: blue; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Smcwg-public@cabforum.org</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><a href="https://lists.cabforum.org/mailman/listinfo/smcwg-public" style="color: blue; text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">https://lists.cabforum.org/mailman/listinfo/smcwg-public</a></div></blockquote></div><br></div></body></html>