<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Slack-Lato;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">We found another program that requires OU. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://www.ksz.fgov.be/sites/default/files/assets/diensten_en_support/08soa_customer2bcss_nl.pdf">https://www.ksz.fgov.be/sites/default/files/assets/diensten_en_support/08soa_customer2bcss_nl.pdf</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I don’t read Dutch, but I guess the government program is rejecting certificates if the certificate does not contain an OU.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Jeremy Rowley <br>
<b>Sent:</b> Wednesday, September 2, 2020 2:29 PM<br>
<b>To:</b> Ryan Sleevi <sleevi@google.com><br>
<b>Cc:</b> CABforum3 <validation@cabforum.org>; Richard Smith <rich@sectigo.com><br>
<b>Subject:</b> RE: [cabf_validation] Revision to OU requirements<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Yeah – we wanted to see what would happen if we turned it off. So far, there hasn’t been a lot of noise. This is the first one we’ve encountered.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">VMware generate the OU as part of the cert request to create a unique identifier. The tool uses that unique identifier to do the installation. Removing the OU is breaking the VMware install tool and causing it not to load the certificate.
We’re reaching out to them to see if we can get them to update their software and stop requiring OU.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a>>
<br>
<b>Sent:</b> Wednesday, September 2, 2020 2:23 PM<br>
<b>To:</b> Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com">jeremy.rowley@digicert.com</a>><br>
<b>Cc:</b> CABforum3 <<a href="mailto:validation@cabforum.org">validation@cabforum.org</a>>; Richard Smith <<a href="mailto:rich@sectigo.com">rich@sectigo.com</a>><br>
<b>Subject:</b> Re: [cabf_validation] Revision to OU requirements<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Wed, Sep 2, 2020 at 4:14 PM Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com">jeremy.rowley@digicert.com</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-top:5.0pt;margin-right:0in;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">We’ve been working to shut off OU completely to see if there are issues with doing so. So far, we’ve found one automation tool that requires OU: <span style="font-size:11.5pt;font-family:Slack-Lato;color:black;background:#F8F8F8"><a href="https://kb.vmware.com/s/article/2044696" target="_blank">https://kb.vmware.com/s/article/2044696</a></span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks Jeremy! I saw DigiCert was taking a good step here, in <a href="https://knowledge.digicert.com/alerts/ou-removal.html">https://knowledge.digicert.com/alerts/ou-removal.html</a> , and think that's a model for all CAs (by virtue of
the BRs)<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm hoping you can share more details about the issue there. Are you saying the system doesn't load a publicly-trusted certificate if it's missing the OU field, or merely that their tool produces CSRs with the OU field populated, as part
of ensuring a globally unique DN?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Much like past work on working out interoperable, standards-based approaches to IP addresses ( <a href="https://cabforum.org/guidance-ip-addresses-certificates/">https://cabforum.org/guidance-ip-addresses-certificates/</a> ), it'd be great
to understand the problem more to see what options we have.<o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>