[cabfpub] Ballot for limited exemption to RFC 5280 for CTimplementation

Rob Stradling rob.stradling at comodo.com
Thu Sep 18 09:52:59 UTC 2014


On 18/09/14 03:01, kirk_hall at trendmicro.com wrote:
<snip>
> Proposed amendments to Baseline Requirements.
>
> New language is shown in */_bold , italics, and underlined._/*
>
> 1. Amend the Definitions as follows:
>
> Valid Certificate:**A Certificate that passes the validation procedure
> specified in RFC 5280 */_(except for the limited exemption provided in
> Appendix B)._/*

Kirk, this proposed change to the "Valid Certificate" definition makes 
no sense to me at all.

I interpret "validation procedure specified in RFC 5280" to mean RFC5280 
Section 6 (entitled "Certification Path Validation"), which has 
absolutely nothing to say about duplicate serial numbers.
(The prohibition on duplicate serial numbers is in RFC5280 Section 4.1.2.2).

I think the "Valid Certificate" definition is intended to include all 
certs that browsers accept, regardless of whether or not they've been 
issued in full compliance with the BRs.  (That's arguably an unfortunate 
use of the word "Valid", but nonetheless I think this is the intent).

> 2. Amend Appendix B as follows:
>
> Appendix B – Certificate Extensions (Normative/)_;*Limited Exemption
> from Compliance with RFC 5280*_/**

Again, this makes no sense.  The serial number field is not a 
certificate extension.

IMHO, the BRs, as written, don't actually incorporate the RFC5280 
Section 4.1.2.2 rule prohibiting duplicate serial numbers.

We could fix this by changing the title of Appendix B to "Certificate 
Fields and Extensions", but until we do that, your proposed limited 
exemption is a no-op.

<snip>

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online



More information about the Public mailing list