<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Clint, Ben,</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
(Sharing here for visibility in addition to GitHub)</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
We can update the policyIdentifier contents in the "No Policy Restrictions (Affiliated CA)" table under sections 7.1.2.2.6 and 7.1.2.10.5 with Ben's suggested text:</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="margin-left: 40px; font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<i>When the Issuing CA wishes to express that there are no policy restrictions, and if the Subordinate CA is an Affiliate of the Issuing CA, then the Issuing CA MAY use the `anyPolicy` Policy Identifier, which MUST be the only `PolicyInformation` value. </i></div>
<div id="appendonsend"></div>
<div class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
and add the following sentence at the end of the paragraph after the table in section 7.1.2.2.6:</div>
<div class="elementToProof" style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="margin-left: 40px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<i>If the Certificate issued under this Certificate Profile is authorized to issue Subscriber certificates, it MUST contain exactly one Reserved Certificate Policy Identifier.</i></div>
<div class="elementToProof" style="margin-left: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<i><br>
</i></div>
<div class="elementToProof" style="margin-left: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Do these changes address your concerns?</div>
<div class="elementToProof" style="margin-left: 0px; font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<i><br>
</i>See also: <a href="https://github.com/cabforum/servercert/pull/544">https://github.com/cabforum/servercert/pull/544</a> <i><br>
<br>
</i></div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Paul</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<hr style="display: inline-block; width: 98%;">
<span style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><b>From:</b> Clint Wilson<br>
<b>Sent:</b> Saturday, September 07, 2024 01:03<br>
<b>To:</b> Bruce Morton<br>
<b>Cc:</b> CA/Browser Forum Validation SC List; Paul van Brouwershaven<br>
<b>Subject:</b> Re: [EXTERNAL] [cabf_validation] Section 7.1.2.10.5 CA Certificate Certificate Policies for cross signing certificates
</span>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>Hi Bruce,</div>
<div><br>
</div>
<div>I agree, but don’t see anything conceptualized in the current TBRs which would represent this. I’m not sure how to fully capture this simply. For part of the prerequisites we’re describing — though I’m pretty sure it’s not a good idea — we could possibly
add this into the hypothetical clarifying language to-be-added to the new Section 7.1.2.2.6 with something along the lines of “the CA Certificate whose Subject Name and Subject Public Key Information are being signed as a Cross-Certified Subordinate CA MUST
contain a basicConstraints:pathLenConstraint and the value of the pathLenConstraint MUST NOT be `0`”. </div>
<div><br>
</div>
<div>However, that kind of requirement doesn’t prohibit such a CA Certificate from issuing Subscriber Certificates and I don’t know of a technical means of representing that a CA Certificate doesn’t issue end-entity certificates and so should not be used by
relying parties in chain validation as the issuing CA of a leaf. Limiting it to Root CA Certificates was the best I could come up with that doesn’t scope creep this change substantially, but hopefully someone else sees something I don’t. If nothing else, we
could probably add that language into this same new Section as a “If a Cross-Certified Subordinate CA contains more than one Reserved Certificate Policy Identifier, it MUST NOT sign Subscriber Certificates” sort of caveat/condition.</div>
<div><br>
</div>
<div>Thanks,</div>
<div>-Clint</div>
<div><br>
</div>
<blockquote>
<div>On Sep 6, 2024, at 1:18 PM, Bruce Morton <Bruce.Morton@entrust.com> wrote:</div>
<br>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
Hi Clint,</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
I think the requirement should apply to a certificate to a CA, which can issue CA certificates. I’m not sure of the right terminology, but I categorize this as a Root-to-Root CA or a Root-to-Intermediate CA Certificate. It would not apply to a CA certificate
where the CA issues Subscriber certificates.</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
Bruce.</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(225, 225, 225) currentcolor currentcolor;">
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;">
<b>From:</b> Validation <validation-bounces@cabforum.org> <b>On Behalf Of </b>Clint Wilson via Validation<br>
<b>Sent:</b> Friday, September 6, 2024 2:45 PM<br>
<b>To:</b> Paul van Brouwershaven <Paul.vanBrouwershaven@entrust.com>; CA/Browser Forum Validation SC List <validation@cabforum.org><br>
<b>Subject:</b> [EXTERNAL] Re: [cabf_validation] Section 7.1.2.10.5 CA Certificate Certificate Policies for cross signing certificates</div>
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
Hi Paul,</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
One concern I have with this change is its impact on the cross-certification of subordinate CAs which directly issue end-entity TLS certificates. That is, I think it appropriate to maintain the requirement/limitation that only one Reserved Certificate Policy
Identifier be included in the Cross-Certified Subordinate CA Certificate where the CA Certificate being signed/certified is a Subordinate CA Certificate as opposed to a Root CA Certificate.</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
Since the introduction to this Profile in Section 7.1.2.2 states that the Profile is the same regardless of whether the “source” CA Certificate is a Root CA Certificate or a Subordinate CA Certificate, I
<i>think</i> this newly added Section 7.1.2.2.6 would need to indicate clearly its scope of applicability against Cross-Certified Subordinate CA Certificate which are the result of issuing a CA Certificate using the same Subject Name and Subject Public Key
Information as an existing Root CA Certificate.</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
It also seems like it may be helpful to clarify that the Certificate Policies extension defined in this newly added Section 7.1.2.2.6 needs to be compatible between the Cross-Certified Subordinate CA and its Issuing CA (though, perhaps, obvious, this would
also help ensure that the separation of pre- and post-SC-062 CA Certificates is maintained, at least in the cases where the `anyPolicy` Policy Identifier is not used). I’m not entirely sure this is necessary, as I suspect it’s required elsewhere within Section
7, but I couldn’t find it in a quick search so thought I’d mention it.</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
Thanks!</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
-Clint</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
<br>
<br>
</div>
<blockquote style="margin-top: 5pt; margin-bottom: 5pt;">
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
On Sep 6, 2024, at 6:21<span style="font-family: Arial, sans-serif;"> </span>AM, Paul van Brouwershaven via Validation <<span style="color: blue;"><u><a href="mailto:validation@cabforum.org" id="OWA38215876-36dc-77b5-1c40-0b1715149ee7" class="OWAAutoLink" style="color: blue;">validation@cabforum.org</a></u></span>>
wrote:</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 12pt;">
</div>
<p style="text-align: left; text-indent: 0px; margin: 0in 0in 12pt; font-family: Aptos, sans-serif; font-size: 12pt;">
<span style="font-size: 11pt;">Following yesterday's discussion in the validation subcommittee teleconference, we are now seeking two members to endorse the ballot. Feedback is also welcome, either here or on the pull request.</span></p>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
### Purpose of the Ballot</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
This ballot duplicates the content of section 7.1.2.10.5 (CA Certificate Certificate Policies) into section 7.1.2.2 (Cross-Certified Subordinate CA Certificate Profile) as section 7.1.2.2.6 (Cross-Certified Subordinate CA Certificate Certificate Policies),
modifying the requirement from "MUST contain exactly one Reserved Certificate Policy Identifier" to "MUST include at least one Reserved Certificate Policy Identifier" to allow the inclusion of multiple Reserved Certificate Policy Identifiers in a Cross-Certified
Subordinate CA Certificate.</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
The following motion has been proposed by Paul van Brouwershaven (Entrust) and endorsed by XXX (XXX) and XXX (XXX).</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
GitHub pull request for this ballot: <span style="color: blue;"><u><a href="https://github.com/cabforum/servercert/pull/544" id="OWA9a1d7845-d758-b000-0b43-f63e6c862e94" class="OWAAutoLink" data-auth="NotApplicable" style="color: blue;">https://github.com/cabforum/servercert/pull/544</a></u></span> </div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
### Motion begins</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
MODIFY the "Baseline Requirements for the Issuance and Management of Publicly-Trusted TLS Server Certificates" ("TLS Baseline Requirements") based on Version 2.0.6 as specified in the following redline:</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt; color: blue;">
<u><a href="https://github.com/cabforum/servercert/compare/929d9b4a1ed1f13f92f6af672ad6f6a2153b8230...89f80028b40ce6a1a5c52b406d37e5534460a1a1" id="OWA03ab3ba0-8082-b5d8-e2b2-52b337b4bd74" class="OWAAutoLink" data-auth="NotApplicable" style="color: blue;">https://github.com/cabforum/servercert/compare/929d9b4a1ed1f13f92f6af672ad6f6a2153b8230...89f80028b40ce6a1a5c52b406d37e5534460a1a1</a></u></div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
### Motion ends</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
Discussion (7+ days)</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
- Start time: TBC</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
- End time: TBC</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
Vote for approval (7 days)</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
- Start time: TBC</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
- End time: TBC</div>
<div align="center" style="margin: 0in;">
<hr align="center" style="text-indent: 0px; width: 601.95pt;">
</div>
<div id="x_divRplyFwdMsg">
<div style="margin: 0in; font-family: Calibri, sans-serif; font-size: 11pt;"><b>From:</b> Validation <<span style="color: blue;"><u><a href="mailto:validation-bounces@cabforum.org" id="OWA720cfd7b-4f23-26cd-c5fd-6c8a55be640a" class="OWAAutoLink" style="color: blue;">validation-bounces@cabforum.org</a></u></span>>
on behalf of Paul van Brouwershaven via Validation <<span style="color: blue;"><u><a href="mailto:validation@cabforum.org" id="OWA474330e9-5985-0138-3ca2-6c1294188a7f" class="OWAAutoLink" style="color: blue;">validation@cabforum.org</a></u></span>><br>
<b>Sent:</b> Thursday, September 5, 2024 16:40<br>
<b>To:</b> CABforum3 <<span style="color: blue;"><u><a href="mailto:validation@cabforum.org" id="OWA968f0609-4b4e-e8e7-afd4-5e89e5321298" class="OWAAutoLink" style="color: blue;">validation@cabforum.org</a></u></span>><br>
<b>Subject:</b> [EXTERNAL] [cabf_validation] Section 7.1.2.10.5 CA Certificate Certificate Policies for cross signing certificates</div>
<div style="margin: 0in; font-family: Helvetica, sans-serif; font-size: 9pt;"> </div>
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
We would like to clarify the following requirement in section 7.1.2.10.5 CA Certificate Certificate Policies, specifically for cross signing certificates.</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
RFC 5280 states that you can have one CertPolicyId within the PolicyInformation, see below:</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: "Courier New"; font-size: 9pt;">
<i>certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation</i></div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: "Courier New"; font-size: 9pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: "Courier New"; font-size: 9pt;">
<i>PolicyInformation ::= SEQUENCE {</i></div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: "Courier New"; font-size: 9pt;">
<i> policyIdentifier </i><b><i>CertPolicyId</i></b><i>,</i></div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: "Courier New"; font-size: 9pt;">
<i> policyQualifiers SEQUENCE SIZE (1..MAX) OF</i></div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: "Courier New"; font-size: 9pt;">
<i> PolicyQualifierInfo OPTIONAL }</i></div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: "Courier New"; font-size: 9pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: "Courier New"; font-size: 9pt;">
<b><i>CertPolicyId </i></b><i>::= OBJECT IDENTIFIER</i></div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
Section 7.1.2.10.5 of the TLS BR states for the policyIdentifier:</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
<i>The CA MUST include </i><b><i><u>at least one</u></i></b><i> Reserved Certificate Policy Identifier (see Section 7.1.6.1) associated with the given Subscriber Certificate type (see Section 7.1.2.7.1) directly or transitively issued by this Certificate.</i></div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
This 'at least one' seems to contradict RFC 5280 which indicates that we can only have one policyIdentifier in the PolicyInformation sequence.</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
Then at the bottom of this section the TLS BRs states that entire certificate policies extension MUST contain exactly one Reserved Certificate Policy Identifier:</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
<i>Regardless of the order of PolicyInformation values, the Certificate Policies extension
</i><b><i><u>MUST contain exactly one</u></i></b><i> Reserved Certificate Policy Identifier.</i></div>
<div style="text-align: left; text-indent: 0px; margin: 0in 0in 0in 40px; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
While we can repeat the PolicyInformation within the certificatePolicies extension does this mean that CAs are prohibited from issuing a cross signing certificate (from a multi-purpose root to another multi-purpose root) with policy contrains that include DV,
OV and EV reserved certificate policy identifiers. If our reading of this section is correct, this would mean that CAs need to issue three seperate cross signing certificates in that case.</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
Paul</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Aptos, sans-serif; font-size: 11pt;">
</div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Helvetica, sans-serif; font-size: 9pt;">
<i>Any email and files/attachments transmitted with it are intended solely for the use of the individual or entity to whom they are addressed. If this message has been sent to you in error, you must not copy, distribute or disclose of the information it contains.
<u>Please notify Entrust immediately and delete the message from your system.</u></i></div>
<div style="text-align: left; text-indent: 0px; margin: 0in; font-family: Helvetica, sans-serif; font-size: 9pt;">
_______________________________________________<br>
Validation mailing list<br>
<span style="color: blue;"><u><a href="mailto:Validation@cabforum.org" id="OWA7beeeefb-29da-559f-d95c-214202417162" class="OWAAutoLink" style="color: blue;">Validation@cabforum.org</a></u></span><br>
<span style="color: blue;"><u><a href="https://lists.cabforum.org/mailman/listinfo/validation" id="OWAd1f41f3c-840d-4727-b113-9968c0e5d67a" class="OWAAutoLink" data-auth="NotApplicable" style="color: blue;">https://lists.cabforum.org/mailman/listinfo/validation</a></u></span></div>
</blockquote>
</blockquote>
<br>
</body>
</html>