[cabfpub] Ballot 150 - OIDs
Rob Stradling
rob.stradling at comodo.com
Thu Sep 3 22:00:53 UTC 2015
Thanks Jeremy.
I've just added https://bugzilla.cabforum.org/show_bug.cgi?id=24 to
track this.
On 03/09/15 22:37, Jeremy Rowley wrote:
> Yes - it was discussed. We decided that since this is the language in the original BRs we should leave it alone and fix the language there in a separate ballot. The only goal in this ballot is to add the optional IV and EV OIDs.
>
> -----Original Message-----
> From: Rob Stradling [mailto:rob.stradling at comodo.com]
> Sent: Thursday, September 3, 2015 3:19 PM
> To: Jeremy Rowley <jeremy.rowley at digicert.com>
> Cc: public at cabforum.org
> Subject: Re: [cabfpub] Ballot 150 - OIDs
>
> Hi Jeremy. Was my comment (see below) discussed at all?
>
> On 21/08/15 11:35, Rob Stradling wrote:
>> Hi Jeremy. The review period coincides with holiday for me, so I'll
>> have to comment early...
>>
>> BRs section 7.1.4.2.2 (which this ballot doesn't touch) says that
>> Subject.localityName is _optional_ whenever Subject.organizationName
>> and Subject.stateOrProvinceName are both included.
>>
>> However, this ballot proposes...
>> "If the Certificate asserts the policy identifier of 2.23.140.1.2.2,
>> then it MUST also include organizationName, localityName,
>> stateOrProvinceName (if applicable), and countryName in the Subject
>> field. If the Certificate asserts the policy identifier of
>> 2.23.140.1.2.3, then it MUST also include (i) either
>> organizationName or givenName and surname, (ii) localityName, (iii)
>> stateOrProvinceName (if applicable), and (iv) countryName in the
>> Subject field."
>> ...which IINM overrides the optionality of Subject.localityName.
>>
>> What's the best way to resolve this inconsistency?
>>
>> Thanks.
>>
>> On 20/08/15 16:25, Jeremy Rowley wrote:
>>> Here’s an updated draft of the OID ballot:
>>>
>>> **
>>>
>>> *Ballot 150-Addition of Optional OID for Individual Validation*
>>>
>>> The following motion has been proposed by Dean Coclin of Symantec
>>> and endorsed by Jeremy Rowley of Digicert and Kirk Hall of Trend Micro.
>>>
>>> -- MOTION BEGINS –
>>>
>>> 1)Modify section 1.2 of Baseline Requirements as follows:
>>>
>>> *1.2 Document Name and Identification*
>>>
>>> This certificate policy (CP) contains the requirements for the
>>> issuance and management of publicly‐trusted SSL certificates, as
>>> adopted by the CA/Browser Forum.
>>>
>>> The following Certificate Policy identifiers are reserved for use by
>>> CAs as an optional means of asserting compliance with this CP (OID
>>> arc
>>> 2.23.140.1.2) as follows:
>>>
>>> {joint‐iso‐itu‐t(2) international‐organizations(23)
>>> ca‐browser‐forum(140) certificate‐policies(1) baseline‐
>>> requirements(2) domain‐validated(1)} (2.23.140.1.2.1);
>>>
>>> {joint‐iso‐itu‐t(2) international‐organizations(23)
>>> ca‐browser‐forum(140) certificate‐policies(1) baseline‐
>>> requirements(2) organization-validated(2)} (2.23.140.1.2.2) and
>>>
>>> _{joint‐iso‐itu‐t(2) international‐organizations(23)
>>> ca‐browser‐forum(140) certificate‐policies(1) baseline‐
>>> requirements(2) individual-validated(3)} (2.23.140.1.2.3)._
>>>
>>> 2)Modify section 7.1.6.1 of the Baseline Requirements as follows:
>>>
>>> **
>>>
>>> *7.1.6.1. Reserved Certificate Policy Identifiers *
>>>
>>> This section describes the content requirements for the Root CA,
>>> Subordinate CA, and Subscriber Certificates, as they relate to the
>>> identification of Certificate Policy.
>>>
>>> The following Certificate Policy identifiers are reserved for use by
>>> CAs as an optional means of asserting compliance with these
>>> Requirements as
>>> follows:
>>>
>>> {joint‐iso‐itu‐t(2) international‐organizations(23)
>>> ca‐browser‐forum(140) certificate‐policies(1)
>>> baseline‐requirements(2) domain‐validated(1)} (2.23.140.1.2.1), if
>>> the Certificate complies with these Requirements but lacks Subject
>>> Identity Information that is verified in accordance with either Section 3.2.2.1 _or Section 3.2.3_.
>>>
>>> If the Certificate asserts the policy identifier of 2.23.140.1.2.1,
>>> then it MUST NOT include organizationName, givenName, surname,
>>> streetAddress, localityName, stateOrProvinceName, or postalCode in the Subject field.
>>>
>>> {joint‐iso‐itu‐t(2) international‐organizations(23)
>>> ca‐browser‐forum(140) certificate‐policies(1)
>>> baseline‐requirements(2) organization-validated(2)} (2.23.140.1.2.2),
>>> if the Certificate complies with these Requirements and includes
>>> Subject Identity Information that is verified in accordance with Section 3.2.2.1.
>>>
>>> _{joint‐iso‐itu‐t(2) international‐organizations(23)
>>> ca‐browser‐forum(140) certificate‐policies(1)
>>> baseline‐requirements(2) individual-validated(3)} (2.23.140.1.2.3),
>>> if the Certificate complies with these Requirements and includes
>>> Subject Identity Information that is verified in accordance with
>>> Section 3.2.3._
>>>
>>> __
>>>
>>> If the Certificate asserts the policy identifier of 2.23.140.1.2.2,
>>> then it MUST also include organizationName, localityName,
>>> stateOrProvinceName (if applicable), and countryName in the Subject
>>> field. _If the Certificate asserts the policy identifier of
>>> 2.23.140.1.2.3, then it MUST also include (i) either organizationName
>>> or givenName and surname,
>>> (ii) localityName, (iii) stateOrProvinceName (if applicable), and
>>> (iv) countryName in the Subject field._
>>>
>>> 3)Modify the definition of “EV OID” in the EV Guidelines as follows:
>>>
>>> *EV OID*: An identifying number, in the form of an “object identifier,”
>>> that is included in the certificatePolicies field of a certificate that:
>>> (i) indicates which CA policy statement relates to that certificate,
>>> and
>>> (ii) _is either the CA/Browser Forum EV policy identifier or a
>>> policy identifier that_, by pre-agreement with one or more
>>> Application Software Supplier, marks the certificate as being an EV Certificate.
>>>
>>> 4)Modify Section 9.3.2 of the EV Guidelines as follows:
>>>
>>> Each EV Certificate issued by the CA to a Subscriber MUST contain a
>>> policy identifier _that is either_ defined by _these Guidelines or
>>> _the CA in the certificate’s certificatePolicies extension that: (i)
>>> indicates which CA policy statement relates to that Certificate, (ii)
>>> asserts the CA’s adherence to and compliance with these Guidelines,
>>> and (iii), _is either the CA/Browser Forum’s EV policy identifier or
>>> a policy identifier that, _by pre-agreement with the Application
>>> Software Supplier, marks the Certificate as being an EV Certificate.
>>>
>>> _The following Certificate Policy identifier is the CA/Browser
>>> Forum’s EV policy identifier: _
>>>
>>> _{joint‐iso‐itu‐t(2) international‐organizations(23)
>>> ca‐browser‐forum(140) certificate‐policies(1) ev-guidelines (1) }
>>> (2.23.140.1.1), if the Certificate complies with these Guidelines._
>>>
>>> If the ballot passes, the custodian of the Forum OIDs will be
>>> instructed to obtain the new OID for IV as indicated above.
>>>
>>> -- MOTION ENDS –
>>>
>>> The review period for this ballot shall commence at 2200 UTC on
>>> Friday, August 21, 2015, and will close at 2200 UTC on Friday, August 27, 2015.
>>> Unless the motion is withdrawn during the review period, the voting
>>> period will start immediately thereafter and will close at 2200 UTC
>>> on Friday, September 4, 2015. Votes must be cast by posting an
>>> on-list reply to this thread.
>>>
>>> A vote in favor of the motion must indicate a clear 'yes' in the
>>> response. A vote against must indicate a clear 'no' in the response.
>>> A vote to abstain must indicate a clear 'abstain' in the response.
>>> Unclear responses will not be counted. The latest vote received from
>>> any representative of a voting member before the close of the voting
>>> period will be counted. Voting members are listed here:
>>> https://cabforum.org/members/
>>>
>>> In order for the motion to be adopted, two thirds or more of the
>>> votes cast by members in the CA category and greater than 50% of the
>>> votes cast by members in the browser category must be in favor.
>>> Quorum is currently nine (9) members– at least nine members must
>>> participate in the ballot, either by voting in favor, voting against, or abstaining.
>>>
>>>
>>>
>>> _______________________________________________
>>> Public mailing list
>>> Public at cabforum.org
>>> https://cabforum.org/mailman/listinfo/public
>>>
>>
>
> --
> Rob Stradling
> Senior Research & Development Scientist
> COMODO - Creating Trust Online
> Office Tel: +44.(0)1274.730505
> Office Fax: +44.(0)1274.730909
> www.comodo.com
>
> COMODO CA Limited, Registered in England No. 04058690 Registered Office:
> 3rd Floor, 26 Office Village, Exchange Quay,
> Trafford Road, Salford, Manchester M5 3EQ
>
> This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender by replying to the e-mail containing this attachment. Replies to this email may be monitored by COMODO for operational or business reasons. Whilst every endeavour is taken to ensure that e-mails are free from viruses, no liability can be accepted and the recipient is requested to use their own virus checking software.
>
--
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online
Office Tel: +44.(0)1274.730505
Office Fax: +44.(0)1274.730909
www.comodo.com
COMODO CA Limited, Registered in England No. 04058690
Registered Office:
3rd Floor, 26 Office Village, Exchange Quay,
Trafford Road, Salford, Manchester M5 3EQ
This e-mail and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they are
addressed. If you have received this email in error please notify the
sender by replying to the e-mail containing this attachment. Replies to
this email may be monitored by COMODO for operational or business
reasons. Whilst every endeavour is taken to ensure that e-mails are free
from viruses, no liability can be accepted and the recipient is
requested to use their own virus checking software.
More information about the Public
mailing list