<div dir="ltr">Moudrick,<div><br></div><div>As an abstract, I can understand the appeal, but perhaps you'd like to propose concrete language for how to validate such a relationship, what sort of formal authorization documents suffice, and of course, the point that has been avoided numerous times in this thread, the purpose for relying party applications, such as browsers, to have such information.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Nov 16, 2020 at 10:34 AM md--- via Validation <<a href="mailto:validation@cabforum.org">validation@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto"><div dir="auto">I think for public sector/government institutions we should use the official name of that organization unit.</div><div dir="auto"><br></div><div dir="auto">E.g., State XYZ regulatory authority (a legal entity) may act as Data Protection Authority.</div><div dir="auto"><br></div><div dir="auto">As a rule XYZ has a formal authorization document for its DPA role.</div><div dir="auto"><br></div><div dir="auto">Thanks,</div><div dir="auto">M.D.</div><div dir="auto"><br></div><div dir="auto"><br></div><div dir="auto"><br></div><div id="gmail-m_-1430519252152634201composer_signature" dir="auto"><div style="font-size:85%;color:rgb(87,87,87)" dir="auto">Sent from my Galaxy</div></div><div dir="auto"><br></div><div><br></div><div align="left" dir="auto" style="font-size:100%;color:rgb(0,0,0)"><div>-------- Original message --------</div><div>From: Paul van Brouwershaven via Validation <<a href="mailto:validation@cabforum.org" target="_blank">validation@cabforum.org</a>> </div><div>Date: 11/16/20 17:14 (GMT+02:00) </div><div>To: <a href="mailto:validation@cabforum.org" target="_blank">validation@cabforum.org</a> </div><div>Subject: Re: [cabf_validation] [EXTERNAL] Draft Ballot SCXX: Improve OU validation requirements </div><div><br></div></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
I have been thinking about a more simplistic and strict approach that doesn't follow all the current allowed methods listed in section 3.2 of the BR like we have proposed currently. </div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
The version below only provides one method that must be followed and always requires a prefix/suffix to be added. I don't think it will satisfy all use cases, but it should be sufficient for the large majority and might be a good compromise:<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<blockquote style="margin:0px 0px 0px 40px;border:none;padding:0px">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<p style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif;background:white" class="MsoNormal">
<i><span style="font-size:12pt;color:black"></span></i></p>
</div>
<span style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"><i>If the Subject Identity Information is to include an organizational unit, then it MUST be preceded or followed by a whitespace and an equivalent of the
word “unit”, “service", "system", "center", "office", “faculty”, "administration", "operations” in singular or plural form; or the equivalent in a language other than English. It SHALL NOT include a name, DBA, tradename, trademark, address, location, or other
text that refers to a specific natural person or Legal Entity unless the CA has verified this information in relation to the Application accordance with Section 3.2.</i></span>
<div><i><br>
</i></div>
<div><span style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"><i>The CA MUST verify the existence and affiliation of the organizational unit with the Applicant using an Organizational Chart provided by an authoritative
source within the Applicant's organization, such as the Applicant's main business offices, corporate offices, human resource offices, information technology offices, or other department that the CA deems appropriate.</i></span></div>
<div><i><br>
</i></div>
<div><span style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)"><i>The value SHALL not be abbreviated unless this would exceed the maximum length of the `subject:organizationalUnitName` field, in which case it SHALL
only use locally accepted abbreviation.</i></span></div>
<br>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<p style="margin:0cm;font-size:11pt;font-family:Calibri,sans-serif;background:white" class="MsoNormal">
<i><span style="font-size:12pt;color:black"></span></i></p>
</div>
</blockquote>
<font face="Calibri, sans-serif" color="#000000">
<div>Feedback and improvements are welcome!</div>
<div><br>
</div>
<div>Paul</div>
</font>
<div><font face="Calibri, sans-serif" color="#000000"><br>
</font></div>
<div><font face="Calibri, sans-serif" color="#000000"><br>
</font></div>
<div id="gmail-m_-1430519252152634201appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div dir="ltr" id="gmail-m_-1430519252152634201divRplyFwdMsg"><font color="#000000" style="font-size:11pt" face="Calibri, sans-serif"><b>From:</b> Paul van Brouwershaven <<a href="mailto:Paul.vanBrouwershaven@entrust.com" target="_blank">Paul.vanBrouwershaven@entrust.com</a>><br>
<b>Sent:</b> Wednesday, November 4, 2020 12:20<br>
<b>To:</b> <a href="mailto:validation@cabforum.org" target="_blank">validation@cabforum.org</a> <<a href="mailto:validation@cabforum.org" target="_blank">validation@cabforum.org</a>>; Paul van Brouwershaven <<a href="mailto:Paul.vanBrouwershaven@entrust.com" target="_blank">Paul.vanBrouwershaven@entrust.com</a>>; Dimitris Zacharopoulos (HARICA) <<a href="mailto:dzacharo@harica.gr" target="_blank">dzacharo@harica.gr</a>><br>
<b>Subject:</b> Re: [EXTERNAL][cabf_validation] Draft Ballot SCXX: Improve OU validation requirements</font>
<div> </div>
</div>
<div dir="ltr">
<div><font face="Open Sans, Helvetica Neue, Helvetica, Arial, sans-serif" color="#666666"><span style="font-size:14px">We got a lot of positive feedback using private channels, with the large majority of CA's indicating that they want to retain the
OU field and willing to support this proposal.</span></font></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(102,102,102);font-family:"Open Sans","Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;background-color:rgb(255,255,255);display:inline"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(102,102,102);font-family:"Open Sans","Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;background-color:rgb(255,255,255);display:inline">Dimitris, you suggested in the virtual meeting 51 to create some “bad actor”
scenarios, I have translated this into the attached risk register.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(102,102,102);font-family:"Open Sans","Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;background-color:rgb(255,255,255);display:inline"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(102,102,102);font-family:"Open Sans","Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;background-color:rgb(255,255,255);display:inline">In the register I have suggested to remove item 6 from the proposal as I don't
think the risk can be mitigated.</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(102,102,102);font-family:"Open Sans","Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;background-color:rgb(255,255,255);display:inline"><br>
</span></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<span style="color:rgb(102,102,102);font-family:"Open Sans","Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;background-color:rgb(255,255,255);display:inline">I would like to invite this group to think about these and other risks, and
if/how they are or can be mitigated.</span></div>
<div id="gmail-m_-1430519252152634201x_appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div dir="ltr" id="gmail-m_-1430519252152634201x_divRplyFwdMsg"><font style="font-size:11pt" color="#000000" face="Calibri, sans-serif"><b>From:</b> Validation <<a href="mailto:validation-bounces@cabforum.org" target="_blank">validation-bounces@cabforum.org</a>> on behalf of Paul van Brouwershaven via Validation <<a href="mailto:validation@cabforum.org" target="_blank">validation@cabforum.org</a>><br>
<b>Sent:</b> Monday, October 19, 2020 10:39<br>
<b>To:</b> <a href="mailto:validation@cabforum.org" target="_blank">validation@cabforum.org</a> <<a href="mailto:validation@cabforum.org" target="_blank">validation@cabforum.org</a>><br>
<b>Subject:</b> [EXTERNAL][cabf_validation] Draft Ballot SCXX: Improve OU validation requirements</font>
<div> </div>
</div>
<div dir="ltr"><font color="#ff0000"><strong>WARNING:</strong></font> This email originated outside of Entrust.<br>
<font color="#ff0000"><strong>DO NOT CLICK</strong></font> links or attachments unless you trust the sender and know the content is safe.<br>
<hr>
<div>As discussed on the last CA/Browser Forum call last week, we would like to retain the OU field. Our enterprise customers have indicated (using a survey) to rely on this field for identifying certificate owners in large organizations and governments.
<div><br>
</div>
<div>With this (draft) ballot we try to align the `subject:organizationalUnitName` with the purpose as described by the ITU-T X.520 section 6.4.2 Organizational Unit Name.</div>
<div><br>
</div>
<div>A few explanations, this ballot:</div>
<div>
<ol>
<li>introduces a requirement to verify the existence and affiliation of the unit with the Applicant</li><li>prevents misinterpretations by requiring self-reported values to be preceded or followed by a whitespace and the well-known words “department”, “division”, “unit” or ...</li><li>supports automation by linking to a directory system of the applicant and by allowing well-known pre-approved values such as “information technology”, “marketing” or “sales”.</li><li>supports manual validation using authoritative sources, an organization charts or public directory (e.g. <a href="https://www.gov.ie/en/help/departments/" target="_blank">https://www.gov.ie/en/help/departments/</a>)</li><li>allows values or series as defined by a government, standard, or regulatory body</li><li>allows certificate tracking using numerals which can be preceded or followed by two alphabetical characters for easier identification.</li></ol>
</div>
<div>Entrust provided a draft ballot redline [1] to improve the OU validation requirements. This is created as a Draft Pull Request to allow others to point out issues, and the current fixed commit version is [2], since [1] will be updated if/as feedback is
received.</div>
<div><br>
</div>
<div>I'm curious for feedback on these proposed changes and looking for potential endorsers for providing a ballot to the CA/Browser Forum's Server Certificate Working Group as a whole. </div>
<div><br>
</div>
<div>[1] <a id="gmail-m_-1430519252152634201LPlnk" href="https://github.com/cabforum/documents/pull/225" target="_blank">https://github.com/cabforum/documents/pull/225</a></div>
<div>[2] <a id="gmail-m_-1430519252152634201LPlnk" href="https://github.com/cabforum/documents/pull/225/commits/33ac251f0105f4ebb55ac22ce0c198796da685c3" target="_blank">
https://github.com/cabforum/documents/pull/225/commits/33ac251f0105f4ebb55ac22ce0c198796da685c3</a></div>
<div><br>
</div>
<div>Thanks,</div>
<div><br>
</div>
<div>Paul van Brouwershaven</div>
<div>Entrust</div>
<br>
<br>
</div>
</div>
</div>
</div>_______________________________________________<br>
Validation mailing list<br>
<a href="mailto:Validation@cabforum.org" target="_blank">Validation@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/validation" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/validation</a><br>
</blockquote></div>