<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Helvetica;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple style='word-wrap:break-word'><div class=WordSection1><p class=MsoNormal>No, the reason it exists is exactly as I described. One individual refused to support SC-17 unless it was included, and SC-17 was very important to allow publicly-trusted PSD2 certificates to be issued. So everybody just sort of cringed and included it, despite the fact that it wasn’t necessary and no one else wanted it. I actually got a lot of private criticism for accepting the compromise, despite the fact that I still believe it was the right thing to do at the time.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>It’s not entirely clear why ETSI should have to explain why they failed to discuss or adopt a certificate extension they never asked for or wanted. If someone wanted that discussion, they could have made a proposal there, but no one did.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Since no software exists that consumes this extension, and the information is entirely redundant with another field, and as I mentioned, most X.509 tools and APIs can’t deal with extensions that aren’t encoded in a string-based format … why exactly is it a required field in EV certificates?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>-Tim<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> Clint Wilson <clintw@apple.com> <br><b>Sent:</b> Wednesday, October 11, 2023 4:48 PM<br><b>To:</b> Tim Hollebeek <tim.hollebeek@digicert.com>; CABforum3 <validation@cabforum.org><br><b>Subject:</b> Re: [cabf_validation] EVG 9.8.2. cabfOrganizationIdentifier<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi Tim,<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>I had thought the point of including cabfOrganizationIdentifier was to enable deprecation of subject:organizationIdentifier, rather than the inverse. It seems it would be minimally appropriate to understand the discussions and/or actions ETSI has taken post SC17 to address the topic of adoption of the CABFOrganizationIdentifier (for example, an explanation of why its adoption was rejected or additional background on why it’s unsuited for ETSI’s use-case(s)) prior to considering moving forward with such a ballot. <o:p></o:p></p></div><div><p class=MsoNormal>FWIW, I attempted to find something along those lines, but was unable to (most likely due to insufficient Google-fu, but perhaps such discussions are not public or perhaps they have not occurred).<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Thanks!<o:p></o:p></p></div><div><p class=MsoNormal>-Clint<o:p></o:p></p><div><p class=MsoNormal><br><br><o:p></o:p></p><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal>On Oct 11, 2023, at 12:57 PM, Tim Hollebeek via Validation <<a href="mailto:validation@cabforum.org">validation@cabforum.org</a>> wrote:<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal>Ballot SC17 added the cabfOrganizationIdentifer, which duplicates the information encoded in the subject:organizationIdentifier field, just in a different format/encoding. The subject:orgID field is standardized by ETSI and used in the processing of eIDAS certificates; on the other hand, to the best of my knowledge, no software has ever been written that processes or uses the cabfOrganzationIdentifier field.<o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal>Is there a good reason to keep requiring the field? It was added as a political compromise to get ballot SC17 passed, but that’s not a good reason to keep around a clunky alternative encoding for information already present in the certificate, in an obscure bespoke ASN.1 format that no tools support or use.<o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal>I’m tempted to write a quick ballot to make it optional, so CAs can start leaving it out.<o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal>-Tim<o:p></o:p></p></div><p class=MsoNormal><span style='font-size:9.0pt;font-family:"Helvetica",sans-serif'>_______________________________________________<br>Validation mailing list<br></span><a href="mailto:Validation@cabforum.org"><span style='font-size:9.0pt;font-family:"Helvetica",sans-serif'>Validation@cabforum.org</span></a><span style='font-size:9.0pt;font-family:"Helvetica",sans-serif'><br></span><a href="https://lists.cabforum.org/mailman/listinfo/validation"><span style='font-size:9.0pt;font-family:"Helvetica",sans-serif'>https://lists.cabforum.org/mailman/listinfo/validation</span></a><o:p></o:p></p></div></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></div></body></html>