<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:DengXian;
panose-1:2 1 6 0 3 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"\@DengXian";
panose-1:2 1 6 0 3 1 1 1 1 1;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-GB" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Ryan,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The reason that this proposal is requiring a documented case-by-case exception is to collect concrete evidence like you are requesting and limit the use case to organizations that depend on the OU and need more time to migrate to an alternative
solution.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">There are several use-cases presented, including tracking, pining, organizational unit identification for management, and most importantly mTLS. This last use case is where we see the biggest impact and need for time, as these organizations
need to change their applications, ldap or move off the public PKI to a private PKI to continue their operations.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The deprecation timeframe should give (most) subscribers the time to stop using the OU and move to alternative solutions, the organizations that require more time to plan, budget and setup a private PKI (for example) would require more
time and these fall in the documented exception period. <o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I think it’s reasonable to state that Prohibited values equals MUST NOT and a Deprecated value is a weaker form of SHOULD NOT.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The following change to the proposed language reflects this interpretation better:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:10.0pt;font-family:Consolas">i. __Certificate Field:__ `subject:organizationalUnitName` (OID: 2.5.4.11)
<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:10.0pt;font-family:Consolas"> __Prohibited__ if the `subject:organizationName` is absent.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:36.0pt"><span style="font-size:10.0pt;font-family:Consolas"> __Prohibited__ after May 31, 2024<br>
__Deprecated__ discouraged, SHOULD NOT be included after May 31, 2022 permitted until prohibited when documented as case-by-case exception.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Paul<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Ryan Sleevi <sleevi@google.com>
<br>
<b>Sent:</b> Tuesday, May 25, 2021 5:01 PM<br>
<b>To:</b> Paul van Brouwershaven <Paul.vanBrouwershaven@entrust.com>; CA/Browser Forum Validation SC List <validation@cabforum.org><br>
<b>Cc:</b> Chema Lopez <clopez@firmaprofesional.com><br>
<b>Subject:</b> [EXTERNAL] Re: [cabf_validation] Deprecating and prohibiting `subject:organizationName`<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">WARNING: This email originated outside of Entrust.<br>
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.<o:p></o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<div>
<p class="MsoNormal">Hi Paul,<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I'm glad to see Entrust has recognized that its previously suggested approach to OU lacks consensus.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">However, we have yet to see any data to support the 2024 deadline, especially when this timeline is functionally not effective deadline of May 31, 2025, due to certificate lifetimes. Given the data presented around the use, and misuse,
of OU, and the many CA incidents, it does not seem like a 2024 date can be reasonably justified, but perhaps there is more concrete data you would like to share? Certainly, Certificate Transparency offers us a clear empirical roadmap to both those affected
and the (previously discussed) use cases, much better than any survey or "customer wishlist" would.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">As per past discussions in the Forum regarding acceptable timeframes, I think the reasonable timeframe that we could endorse would look to see it immediately moved to a SHOULD NOT, with a goal of MUST NOT on roughly the timeframe you propose
(May 2022, or approximately one year out). This would allow us to ensure that data is promptly gathered as soon as possible, through the SHOULD NOT transition, and ensure that if there is data that warrants it, relevant to the risk to users and certificate
holders, that we can revisit that timeline if it proves to be necessary.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">However, the process of "documented case-by-case exception" is, while conceptually interesting, deeply problematic, and something that I don't think we could support. This process fundamentally repeats the mistakes that we're trying to
correct with OU, which is to allow a subjective, inconsistent, non-industry standard approach that exposes users and browsers to unnecessary risk, both in interpretation and action. You may recall similar proposals with SHA-1, and the particular repeat failures
of CAs to adhere to those processes discussed. We have zero reason to believe things have improved; indeed, evidence to the contrary is readily apparent even in CA non-compliance issues in the past few months. Because of this, while interesting, it certainly
does not seem to find the right user security balance.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">While these are ultimately things that can be directly addressed by root program policies to the CAs within those root programs, we are certainly interested in seeing if there is a reasonable point in the Forum for discussion. While this
draft ballot does not yet factor in the many conversations that have been had, or the concerns that have been raised, we look forward to working with you on a more reasonable timeframe, and with a more reasonable process in play. Again, using the past experiences
of the Forum, anything that does not "immediately" SHOULD NOT would be certainly not setting up site operators for success, as they replace certificates this year, but we do believe you're on the right track to gathering and producing explicit documentation
on the use cases here as the year progresses, to allow us to revisit if there are any use cases that have not yet been exhaustively discussed.<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Tue, May 25, 2021 at 9:47 AM Paul van Brouwershaven via Validation <<a href="mailto:validation@cabforum.org">validation@cabforum.org</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Entrust is proposing this change to deprecate and finally prohibit the `subject:organizationName` as a follow-up to our previous proposal that failed to gain consensus on the way to improve the
validation. Ben Wilson from Mozilla and Chema Lopez from Firmaprofesional have indicated to endorse this proposal to deprecation and finally prohibit the OU.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Before we submit the ballot, we would like to know if the members of the validation working group are fine with the definition 'documented case-by-case exception' that is required in this proposal
and expects the CA to create or collect documentation on why this exception was required.</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<blockquote>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black">i. __Certificate Field:__ `subject:organizationalUnitName` (OID: 2.5.4.11) </span><span style="font-size:12.0pt;color:black">
<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black"> __Required/Optional:__ __Optional__. </span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black"> __Required/Optional:__
</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black"> __Prohibited__ if the `subject:organizationName` is absent.</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black"> __Prohibited__ after May 31, 2022 but allowed as a documented case-by-case exception until and including May 31, 2024.</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:10.0pt;font-family:"Courier New";color:black"> __Deprecated__ discouraged until prohibited.</span><span style="font-size:12.0pt;color:black"><o:p></o:p></span></p>
</blockquote>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><a href="https://urldefense.com/v3/__https:/github.com/cabforum/servercert/compare/main...vanbroup:oudeprecation__;!!FJ-Y8qCqXTj2!LkCSdi3Y8xLWbRQcWc939DT_y-Jq1n9iMefs53Y4Nm799IzlFugWWxPKiBal13CdBkUhYtNm8w$" target="_blank">Comparing
cabforum:main...vanbroup:oudeprecation · cabforum/servercert (github.com)</a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black">Thanks,<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><br>
Paul<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
</div>
<p class="MsoNormal">_______________________________________________<br>
Validation mailing list<br>
<a href="mailto:Validation@cabforum.org" target="_blank">Validation@cabforum.org</a><br>
<a href="https://urldefense.com/v3/__https:/lists.cabforum.org/mailman/listinfo/validation__;!!FJ-Y8qCqXTj2!LkCSdi3Y8xLWbRQcWc939DT_y-Jq1n9iMefs53Y4Nm799IzlFugWWxPKiBal13CdBkXq54Sveg$" target="_blank">https://lists.cabforum.org/mailman/listinfo/validation</a><o:p></o:p></p>
</blockquote>
</div>
</div>
</body>
</html>