<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
h2
{mso-style-priority:9;
mso-style-link:"Heading 2 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:18.0pt;
font-family:"Calibri",sans-serif;
color:black;
font-weight:bold;}
h3
{mso-style-priority:9;
mso-style-link:"Heading 3 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:13.5pt;
font-family:"Calibri",sans-serif;
color:black;
font-weight:bold;}
h4
{mso-style-priority:9;
mso-style-link:"Heading 4 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Calibri",sans-serif;
color:black;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.Heading2Char
{mso-style-name:"Heading 2 Char";
mso-style-priority:9;
mso-style-link:"Heading 2";
font-family:"Calibri Light",sans-serif;
color:#2F5496;}
span.Heading3Char
{mso-style-name:"Heading 3 Char";
mso-style-priority:9;
mso-style-link:"Heading 3";
font-family:"Calibri Light",sans-serif;
color:#1F3763;}
span.Heading4Char
{mso-style-name:"Heading 4 Char";
mso-style-priority:9;
mso-style-link:"Heading 4";
font-family:"Calibri Light",sans-serif;
color:#2F5496;
font-style:italic;}
span.EmailStyle25
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:944846279;
mso-list-template-ids:-1186970146;}
@list l1
{mso-list-id:1435631935;
mso-list-template-ids:-416152430;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2
{mso-list-id:1466895209;
mso-list-template-ids:-1183567326;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:"Courier New";
mso-bidi-font-family:"Times New Roman";}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;
mso-ansi-font-size:10.0pt;
font-family:Wingdings;}
@list l3
{mso-list-id:1946689005;
mso-list-template-ids:-1386164414;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body bgcolor="white" lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:windowtext">Dimitris<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext">I would like to clarify what I said – see edits below<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:windowtext"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:windowtext">From:</span></b><span style="color:windowtext"> Validation <validation-bounces@cabforum.org>
<b>On Behalf Of </b>Dimitris Zacharopoulos (HARICA) via Validation<br>
<b>Sent:</b> Thursday, July 14, 2022 12:20 PM<br>
<b>To:</b> validation@cabforum.org<br>
<b>Subject:</b> [cabf_validation] Draft Minutes for the Validation Subcommittee Server Certificate Working Group Teleconference - July 14, 2022<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><br>
These are the Draft Minutes of the Teleconference described in the subject of this message as prepared by Dimitris Zacharopoulos (HARICA).<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Please review the minutes and propose edits if necessary. These minutes will be considered for approval at the next meeting. The recording of the meeting will be deleted once the
minutes are approved.<o:p></o:p></p>
<h2 id="attendees">Attendees (in alphabetical order)<o:p></o:p></h2>
<ol start="1" type="1">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Aaron Poulsen - Amazon Trust Services<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Andrea Holland - SecureTrust<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Aneta Wojtczak - Microsoft<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Ben Wilson - Mozilla<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Chris Clements - Google<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Clint Wilson - Apple<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Corey Bonnell - Digicert<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Dimitris Zacharopoulos - HARICA<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Dustin Hollenback - Microsoft<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Janet Hines - SecureTrust<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Joanna Fox - TrustCor Systems<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Joe Ramm - OATI<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Michael Slaughter - Amazon Trust Services<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Michelle Coon - OATI<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Trevoli Ponds-White - Amazon Trust Services<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Wayne Thayer - Fastly<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Tobias Josefowitz - Opera<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Tyler Myers - Godaddy<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l0 level1 lfo1">
Wendy Brown - FPKI<o:p></o:p></li></ol>
<h2 id="antitrust-statement">Antitrust statement<o:p></o:p></h2>
<p>The Antitrust Statement was read.<o:p></o:p></p>
<h2 id="approval-of-minutes">Approval of minutes<o:p></o:p></h2>
<p>Two sets of meetings were approved:<o:p></o:p></p>
<ul type="disc">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo2">
June 16, 2022<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l1 level1 lfo2">
June 30, 2022<o:p></o:p></li></ul>
<h2 id="agenda">Agenda<o:p></o:p></h2>
<ol start="1" type="1">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l3 level1 lfo3">
Review list of discussions at the F2F (<a href="https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Flists.cabforum.org%2Fpipermail%2Fvalidation%2F2022-July%2F001778.html&data=05%7C01%7Cwendy.brown%40protiviti.com%7C2bf708b2dc19486c0ebb08da65b4aed7%7C16532572d5674d678727f12f7bb6aed3%7C0%7C0%7C637934123957607921%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=DhTyCxyE3HcE4XGCj49wrO1PPZ8lqb57CBl6gYL5ePc%3D&reserved=0">https://lists.cabforum.org/pipermail/validation/2022-July/001778.html</a>)<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l3 level1 lfo3">
Call for volunteers to draft language for the various items discussed<o:p></o:p></li></ol>
<h2 id="minutes">Minutes<o:p></o:p></h2>
<p>Corey gave an update about the relocation of the profiles work that moved to a cabf GitHub branch
<a href="https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcabforum%2Fservercert%2Fpull%2F373&data=05%7C01%7Cwendy.brown%40protiviti.com%7C2bf708b2dc19486c0ebb08da65b4aed7%7C16532572d5674d678727f12f7bb6aed3%7C0%7C0%7C637934123957607921%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=1ABZ%2BdbvUrgMTOVhpK%2BhAKPRig6yKfnUL10oMLPPhRA%3D&reserved=0">
https://github.com/cabforum/servercert/pull/373</a><o:p></o:p></p>
<h3 id="review-of-list-of-discussions-at-the-f2f">Review of list of discussions at the F2F<o:p></o:p></h3>
<p>Clint made a general comment that he wants to avoid a possible misunderstanding that just because some requirements are more explicitly stated in the new version doesn't mean that the requirements were not existent in the current version. It should not be
interpreted that if it is now explicitly stated it's not already a requirement in existing language. Some of those requirements are infered by normative RFCs and other parts of the BRs.<o:p></o:p></p>
<h4 id="top-level-effective-date-for-new-profile">Top-level effective date for new profile<o:p></o:p></h4>
<p>No discussion.<o:p></o:p></p>
<h4 id="allow-for-previous-version-of-the-profile-until-new-effective-date">Allow for previous version of the profile until new effective date<o:p></o:p></h4>
<p>No discussion.<o:p></o:p></p>
<h4 id="defer-prohibition-on-keyagreement-in-ecdsa-certs-and-dataencipherment-until-v2">
Defer prohibition on keyAgreement in ECDSA certs and dataEncipherment until v2<o:p></o:p></h4>
<p>For the prohibition of those two KeyUsages, Clint believes some restrictions are already in place today because it should be considered not just based on the KU and algorithm but also in combination of the id-kp-serverAuth EKU. However, he's ok to defer
to v2 but CAs must not conflict with existing RFCs.<o:p></o:p></p>
<h3 id="add-carve-out-for-multiple-dc-attributes-grid">Add carve-out for multiple DC attributes (GRID)<o:p></o:p></h3>
<p>Clint wants to address this and respond to the GRID community.<o:p></o:p></p>
<p>Corey mentioned that we should not include the DC in the SAN values and restore ballot 110 language. Clint agreed.<o:p></o:p></p>
<h3 id="update-subject-attribute-validation-requirements-to-not-require-3.2.2.4-validation-for-those-fields-whose-validation-steps-are-documented-in-the-brs">
Update subject attribute validation requirements to not require 3.2.2.4 validation for those fields whose validation steps are documented in the BRs<o:p></o:p></h3>
<p>Corey reminded that the issue was if a Domain Name is included in the Certificate, what elements need to be validated. Clint understands that addressing this issue may cause more issues than it resolves so he wants to be careful.<o:p></o:p></p>
<h3 id="call-for-volunteers-to-draft-language-for-the-various-items-discussed">Call for volunteers to draft language for the various items discussed<o:p></o:p></h3>
<p>Dimitris offered to assist in the language for the DC attributes for the GRID certificates.<o:p></o:p></p>
<p>Corey will reach out to Tim Hollebeek to try to take a stab on the first two items. Clint can assist in those items too.<o:p></o:p></p>
<p>Aneta volunteered to draft language for the two Key Usages issue.<o:p></o:p></p>
<p>Corey will take a stab at the last one.<o:p></o:p></p>
<p>Wendy Brown asked about the request to make the AKI a SHOULD in the Root Certificate.
<s>She asked Microsoft Engineers and their response was that they decide on the path before reading the Root Certificate.</s><s><span style="color:windowtext">
</span></s><span style="color:#7030A0">I said I had asked Microsoft employees who told me they had checked with the CAPI team and were told that the path decision would be based on other factors before CAPI would check whether the AKI was present in a root
certificate and matched the SKI in that certificate. (Although I didn’t have the email during the call the exact response I had received was: “</span><i><span style="font-family:"Arial",sans-serif;color:#7030A0;background:white">If a cross-certificate is
preferred, it would be for other reasons and not the absence of the AKI in the root. If the AKI isn’t present, then, the encoded Issuer and Subject names must be identical in a root. I would expect other fields in the cert, such as NotBefore/NotAfter to be
used before AKI would even be considered.”)</span></i><span style="color:#7030A0"><o:p></o:p></span></p>
<p>Dustin said he would ask around but might not get a definitive answer.<o:p></o:p></p>
<p><s>Wendy mentioned that this information came from the Microsoft CAPI team.<o:p></o:p></s></p>
<p>Aneta mentioned that AKI/SKI is first checked for path building. If it is not set, then the subject/issuerDN values are used. She will check and confirm.<o:p></o:p></p>
<p>Clint: AKI matching/chain-building, here's an (older) article that describes how AKI is used in some older Windows versions:
<a href="https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsocial.technet.microsoft.com%2Fwiki%2Fcontents%2Farticles%2F4954.windows-xp-certificate-status-and-revocation-checking.aspx%23Path_Construction_and_Validation&data=05%7C01%7Cwendy.brown%40protiviti.com%7C2bf708b2dc19486c0ebb08da65b4aed7%7C16532572d5674d678727f12f7bb6aed3%7C0%7C0%7C637934123957764148%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&sdata=k%2BnmJulpr0d%2FS%2B0ejZWWJPw603%2F6qeAPXP9OoWnXPww%3D&reserved=0">
https://social.technet.microsoft.com/wiki/contents/articles/4954.windows-xp-certificate-status-and-revocation-checking.aspx#Path_Construction_and_Validation</a><o:p></o:p></p>
<p>Corey recalled Wendy asking a question about the policyConstraints extension. Upcoming prohibition in OCSP responders might cause a problem because the FPKI requires all Certificates to include a certificatePolicies extension, including OCSP responder Certificates.<o:p></o:p></p>
<p>Dimitris asked whether the inclusion of the certificatePolicies extension in an OCSP Responder Certificate is currently prohibited.<o:p></o:p></p>
<p>Wendy mentioned that it's not clearly restricted. Corey confirms that there are no restrictions for the OCSP responder certificate profiles except for the id-pkix-ocsp-nocheck (RFC6960) extension.<o:p></o:p></p>
<p>Corey said we can add future effective date for such a change. Clint mentioned that this change should have its own effective date outside of the top-level one.<o:p></o:p></p>
<p>Wendy asked about the Subject Information Access extension in Root Certificates. Corey mentioned that it is a SHOULD NOT as captured by the "any other extensions" clause in the BRs.<o:p></o:p></p>
<h2 id="any-other-business">Any Other Business<o:p></o:p></h2>
<p>Corey said there are other topics in the backlog. He was thinking that we could split the first 30' to discuss about the profiles work and the rest on other topics from the backlog.<o:p></o:p></p>
<p>He mentioned some topics:<o:p></o:p></p>
<ul type="disc">
<li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo4">
EV Guidelines pointing to the BRs for some common areas<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo4">
Delegation to the CA for Domain Validation<o:p></o:p></li><li class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-list:l2 level1 lfo4">
Securing Domain Validations (RPKI, DNSSEC)<o:p></o:p></li></ul>
<p>Clint mentioned his interest to discuss some OCSP SLA improvements. Corey mentioned that this is work in progress at the NetSec WG and asked Clint to ask on the servercert list.<o:p></o:p></p>
<p>Wayne said that if a person wants to drive discussion on a certain topic, we should prioritize that topic. Clint agreed.<o:p></o:p></p>
<p>Dimitris mentioned that it might be a good idea to review a list of currently open issues on the next call, remove topics that are no longer interesting, add others that are of current interest, and prioritize. Wayne and Corey agreed to proceed with this.<o:p></o:p></p>
<p>Wayne wanted to add an issue regarding methods 6 and 19 whether a CA must follow HSTS directives. If they use HTTPS, should they properly validate the certificate chain? What root store should they use? It's not very clear in the current BRs but it might
make sense to clarify in a future revision of the BRs.<o:p></o:p></p>
<p>Corey thinks this is a good topic to discuss. By extension, some similar questions apply to the Domain Validation methods related to the DNS protocols.<o:p></o:p></p>
<h2 id="next-call-is-scheduled-for-july-28th">Next call<o:p></o:p></h2>
<p id="next-call-is-scheduled-for-july-28th">scheduled for July 28th<o:p></o:p></p>
<h2>Adjourned<o:p></o:p></h2>
</div>
NOTICE: Protiviti is a global consulting and internal audit firm composed of experts specializing in risk and advisory services. Protiviti is not licensed or registered as a public accounting firm and does not issue opinions on financial statements or offer
attestation services. This electronic mail message is intended exclusively for the individual or entity to which it is addressed. This message, together with any attachment, may contain confidential and privileged information. Any views, opinions or conclusions
expressed in this message are those of the individual sender and do not necessarily reflect the views of Protiviti Inc. or its affiliates. Any unauthorized review, use, printing, copying, retention, disclosure or distribution is strictly prohibited. If you
have received this message in error, please immediately advise the sender by reply email message to the sender and delete all copies of this message. Thank you.
</body>
</html>