[cabfpub] IV OID Ballot 150

[Rob Stradling]

"If the Certificate asserts the policy identifier of 2.23.140.1.2.1, 
then it MUST NOT include organizationName, streetAddress, localityName, 
stateOrProvinceName, or postalCode in the Subject field."

I think givenName and surname should be added to this MUST NOT list. 
Domain validation doesn't typically validate a person's name!


On 15/07/15 23:33, Dean Coclin wrote:
> Based on input from Mads, we are going to make a slight modification to
> this ballot which I believe is not substantial enough to restart the
> ballot period. The change is noted in Green, below the part that is
> crossed out. A PDF is enclosed.
>
> Voting will start tomorrow.
>
> Thanks,
> Dean
>
> *From:*public-bounces at cabforum.org [mailto:public-bounces at cabforum.org]
> *On Behalf Of *Dean Coclin
> *Sent:* Wednesday, July 08, 2015 5:12 PM
> *To:* public at cabforum.org
> *Subject:* [cabfpub] IV OID Ballot 150
>
> I’m reintroducing this ballot based on the meeting in Zurich. I’ll write
> a separate ballot for the EV, and EV Code Signing OIDs.
>
> I have highlighted changes to the existing language so hopefully
> everyone can see the changes. I’ve also enclosed a pdf version.
>
> Endorsers: I assume you are still good with this? There are no changes.
>
> Thanks,
> Dean
>
> *Ballot 150-Addition of Optional OID for Individual Validation*
>
> The following motion has been proposed by Dean Coclin of Symantec and
> endorsed by Jeremy Rowley of Digicert and Kirk Hall of Trend Micro
>
> -- MOTION BEGINS –
>
> Modify section 1.2 of Baseline Requirements as follows:
>
> *1.2 Document Name and Identification*
>
> This certificate policy (CP) contains the requirements for the issuance
> and management of publicly‐trusted SSL certificates, as adopted by the
> CA/Browser Forum.
>
> The following Certificate Policy identifiers are reserved for use by CAs
> as an optional means of asserting compliance with this CP (OID arc
> 2.23.140.1.2) as follows:
>
> {joint‐iso‐itu‐t(2) international‐organizations(23)
> ca‐browser‐forum(140) certificate‐policies(1) baseline‐ requirements(2)
> domain‐validated(1)} (2.23.140.1.2.1);
>
> {joint‐iso‐itu‐t(2) international‐organizations(23)
> ca‐browser‐forum(140) certificate‐policies(1) baseline‐ requirements(2)
> organization-validated(2)} (2.23.140.1.2.2) and
>
> {joint‐iso‐itu‐t(2) international‐organizations(23)
> ca‐browser‐forum(140) certificate‐policies(1) baseline‐ requirements(2)
> individual-validated(3)} (2.23.140.1.2.3).
>
> Modify section 7.1.6.1 as follows:
>
> *7.1.6.1. Reserved Certificate Policy Identifiers *
>
> This section describes the content requirements for the Root CA,
> Subordinate CA, and Subscriber Certificates, as they relate to the
> identification of Certificate Policy.
>
> The following Certificate Policy identifiers are reserved for use by CAs
> as an optional means of asserting compliance with these Requirements as
> follows:
>
> {joint‐iso‐itu‐t(2) international‐organizations(23)
> ca‐browser‐forum(140) certificate‐policies(1) baseline‐requirements(2)
> domain‐validated(1)} (2.23.140.1.2.1), if the Certificate complies with
> these Requirements but lacks Subject Identity Information that is
> verified in accordance with either Section 3.2.2.1 or Section 3.2.3.
>
> If the Certificate asserts the policy identifier of 2.23.140.1.2.1, then
> it MUST NOT include organizationName, streetAddress, localityName,
> stateOrProvinceName, or postalCode in the Subject field.
>
> {joint‐iso‐itu‐t(2) international‐organizations(23)
> ca‐browser‐forum(140) certificate‐policies(1) baseline‐requirements(2)
> organization-validated(2)} (2.23.140.1.2.2), if the Certificate complies
> with these Requirements and includes Subject Identity Information that
> is verified in accordance with Section 3.2.2.1.
>
> {joint‐iso‐itu‐t(2) international‐organizations(23)
> ca‐browser‐forum(140) certificate‐policies(1) baseline‐requirements(2)
> individual-validated(3)} (2.23.140.1.2.3), if the Certificate complies
> with these Requirements and includes Subject Identity Information that
> is verified in accordance with Section 3.2.3.
>
> If the Certificate asserts the policy identifier of either
> 2.23.140.1.2.2or 2.23.140.1.2.3 , then it MUST also include
> organizationName, localityName, stateOrProvinceName (if applicable), and
> countryName in the Subject field.
>
> If the Certificate asserts the policy identifier of 2.23.140.1.2.2, then
> it MUST also include organizationName, localityName, stateOrProvinceName
> (if applicable), and countryName in the Subject field. If the
> Certificate asserts the policy identifier of 2.23.140.1.2.3, then it
> MUST also include (i) either organizationName or givenName and surname,
> (ii) localityName, (iii) stateOrProvinceName (if applicable), and (iv)
> tcountryName in the Subject field
>
> If the ballot passes, the custodian of the Forum OIDs will be instructed
> to obtain the new OID for IV as indicated above.
>
> -- MOTION ENDS –
>
> The review period for this ballot shall commence at 2200 UTC on Thursday
> July 9, 2015, and will close at 2200 UTC on Thursday 16 July 2015.
> Unless the motion is withdrawn during the review period, the voting
> period will start immediately thereafter and will close at 2200 UTC on
> Thursday, 23 July 2015. Votes must be cast by posting an on-list reply
> to this thread.
>
> A vote in favor of the motion must indicate a clear 'yes' in the
> response. A vote against must indicate a clear 'no' in the response. A
> vote to abstain must indicate a clear 'abstain' in the response. Unclear
> responses will not be counted. The latest vote received from any
> representative of a voting member before the close of the voting period
> will be counted. Voting members are listed here:
> https://cabforum.org/members/
>
> In order for the motion to be adopted, two thirds or more of the votes
> cast by members in the CA category and greater than 50% of the votes
> cast by members in the browser category must be in favor. Quorum is
> currently nine (9) members– at least nine members must participate in
> the ballot, either by voting in favor, voting against, or abstaining.
>
>
>
> _______________________________________________
> Public mailing list
> Public at cabforum.org
> https://cabforum.org/mailman/listinfo/public
>

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
Office Tel: +44.(0)1274.730505
Office Fax: +44.(0)1274.730909
www.comodo.com

COMODO CA Limited, Registered in England No. 04058690
Registered Office:
   3rd Floor, 26 Office Village, Exchange Quay,
   Trafford Road, Salford, Manchester M5 3EQ

This e-mail and any files transmitted with it are confidential and 
intended solely for the use of the individual or entity to whom they are 
addressed.  If you have received this email in error please notify the 
sender by replying to the e-mail containing this attachment. Replies to 
this email may be monitored by COMODO for operational or business 
reasons. Whilst every endeavour is taken to ensure that e-mails are free 
from viruses, no liability can be accepted and the recipient is 
requested to use their own virus checking software.