[cabfpub] Ballot 134 - Application of RFC 5280 to Precertificates

Ben Wilson ben.wilson at digicert.com
Fri Oct 3 00:16:47 UTC 2014

From: kirk_hall at trendmicro.com<mailto:kirk_hall at trendmicro.com>
Sent: ‎10/‎2/‎2014 6:07 PM
To: Ben Wilson<mailto:ben.wilson at digicert.com>; CABFPub<mailto:public at cabforum.org>
Subject: RE: [cabfpub] Ballot 134 - Application of RFC 5280 to Precertificates

Ben, I intended for the Ballot to include the following at the end (not part of the substantive language of the BR amendment):

“Effective Date:  Upon adoption by the Members.”

The endorsers also agree with this.  Can you treat this as part of the Ballot?

From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org] On Behalf Of Ben Wilson
Sent: Thursday, October 02, 2014 12:31 PM
Subject: [cabfpub] Ballot 134 - Application of RFC 5280 to Precertificates

Ballot 134 - Application of RFC 5280 to Precertificates
Kirk Hall of Trend Micro made the following motion, and Ben Wilson of Digicert and Ryan Sleevi from Google have endorsed it.
Reason for Ballot
CAs are implementing Certificate Transparency (CT) based on RFC 6962, which contains the concept of pre-certificates. The current Baseline Requirements require all certificates to comply with RFC 5280. (See Definition of "Valid Certificate" and references to RFC 5280 in Appendix B.) For some implementations, there is a potential dilemma if the pre-certificate and the production certificate are issued from the same sub-CA and both have the same Serial Number, not permitted under RFC 5280. Given that CAs will likely be implementing CT before potential technical differences can be worked out, the purpose of this ballot is to allow CAs to meet CT deadlines without violating the Baseline Requirements requiring compliance with RFC 5280.
-- Motion Begins --
Effective immediately, the title to Appendix B of the Baseline Requirements shall be amended as follows:

  *   Appendix B – Certificate Content and Extensions; Application of RFC 5280 (Normative)
  *   This appendix specifies the additional requirements for Certificate content and extensions for Certificates generated after the Effective Date.
and a new subsection (5) will be added as follows:
(5) Application of RFC 5280
For purposes of clarification, a Precertificate as described in RFC 6962 – Certificate Transparency shall not be considered to be a “certificate” subject to the requirements of RFC 5280 - Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile under these Baseline Requirements.
-- Motion Ends --
The review period for this ballot shall commence at 2200 UTC on Thursday, 2 October 2014, and will close at 2200 UTC on Thursday, 9 October 2014. Unless the motion is withdrawn during the review period, the voting period will start immediately thereafter and will close at 2200 UTC on Thursday, 16 October 2014. Votes must be cast by posting an on-list reply to this thread.
A vote in favor of the motion must indicate a clear 'yes' in the response. A vote against must indicate a clear 'no' in the response. A vote to abstain must indicate a clear 'abstain' in the response. Unclear responses will not be counted. The latest vote received from any representative of a voting member before the close of the voting period will be counted. Voting members are listed here: https://cabforum.org/members/
In order for the motion to be adopted, two thirds or more of the votes cast by members in the CA category and greater than 50% of the votes cast by members in the browser category must be in favor. Quorum is currently nine (9) members– at least nine members must participate in the ballot, either by voting in favor, voting against, or abstaining.

The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20141003/f139c8cf/attachment-0003.html>

More information about the Public mailing list