<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="">As discussed on the last CA/Browser Forum call last week, we would like to retain the OU field. Our enterprise customers have indicated (using a survey) to rely on this field for identifying certificate owners in large organizations and governments.
<div><br>
</div>
<div>With this (draft) ballot we try to align the `subject:organizationalUnitName` with the purpose as described by the ITU-T X.520 section 6.4.2 Organizational Unit Name.</div>
<div><br>
</div>
<div>A few explanations, this ballot:</div>
<div>
<ol>
<li>introduces a requirement to verify the existence and affiliation of the unit with the Applicant</li><li>prevents misinterpretations by requiring self-reported values to be preceded or followed by a whitespace and the well-known words “department”, “division”, “unit” or ...</li><li>supports automation by linking to a directory system of the applicant and by allowing well-known pre-approved values such as “information technology”, “marketing” or “sales”.</li><li>supports manual validation using authoritative sources, an organization charts or public directory (e.g. https://www.gov.ie/en/help/departments/)</li><li>allows values or series as defined by a government, standard, or regulatory body</li><li>allows certificate tracking using numerals which can be preceded or followed by two alphabetical characters for easier identification.</li></ol>
</div>
<div>Entrust provided a draft ballot redline [1] to improve the OU validation requirements. This is created as a Draft Pull Request to allow others to point out issues, and the current fixed commit version is [2], since [1] will be updated if/as feedback is
received.</div>
<div><br>
</div>
<div>I'm curious for feedback on these proposed changes and looking for potential endorsers for providing a ballot to the CA/Browser Forum's Server Certificate Working Group as a whole. </div>
<div><br>
</div>
<div>[1] <a href="https://github.com/cabforum/documents/pull/225" id="LPlnk">https://github.com/cabforum/documents/pull/225</a></div>
<div>[2] <a href="https://github.com/cabforum/documents/pull/225/commits/33ac251f0105f4ebb55ac22ce0c198796da685c3" id="LPlnk">
https://github.com/cabforum/documents/pull/225/commits/33ac251f0105f4ebb55ac22ce0c198796da685c3</a></div>
<div><br>
</div>
<div>Thanks,</div>
<div><br>
</div>
<div>Paul van Brouwershaven</div>
<div>Entrust</div>
<br>
<br>
</div>
</body>
</html>