[cabfpub] Ballot 161 - Notification of incorrect issuance

["Barreira Iglesias, Iñigo"]

Well, not so easy. For sure it affects all EU CAs, but also non EU CAs that are affected or are going to be affected by eIDAS, for example, Globalsign is in Belgium, I think, they´re affected. If Comodo is joining the UK TL, then, it will be affected, if Symantec is going to be established somewhere in Europe, then will be affected, ... and also for those that have agreed with the EU. The article 19 mandates for qualified and non qualified under MS supervision, so established in Europe.
Actually, there are about 150 qualified TSPs in the EU TL and a similar number of non qualified TSPs, so, it´s a big number to notice and most of them haven´t ever heard of CABF.

And it´s not only an email, which is not a big issue, but also to make a report with some information that maybe is not requested by the regulation, so, I wouldn´t like to make 2 reports (probably will be similar, but don´t know now) and another issue is the effectiveness, which is very appropriate as per eIDAS but again, don´t know if the ENISA procedure & tool will be ready by then.


Iñigo Barreira
Responsable del Área técnica
i-barreira at izenpe.eus 
945067705



ERNE! Baliteke mezu honen zatiren bat edo mezu osoa legez babestuta egotea. Mezua badu bere hartzailea. Okerreko helbidera heldu bada (helbidea gaizki idatzi, transmisioak huts egin) eman abisu igorleari, korreo honi erantzuna. KONTUZ!
ATENCION! Este mensaje contiene informacion privilegiada o confidencial a la que solo tiene derecho a acceder el destinatario. Si usted lo recibe por error le agradeceriamos que no hiciera uso de la informacion y que se pusiese en contacto con el remitente.

-----Mensaje original-----
De: Gervase Markham [mailto:gerv at mozilla.org] 
Enviado el: viernes, 29 de enero de 2016 17:01
Para: Barreira Iglesias, Iñigo; Sigbjørn Vik; public at cabforum.org
Asunto: Re: [cabfpub] Ballot 161 - Notification of incorrect issuance

On 29/01/16 13:45, "Barreira Iglesias, Iñigo" wrote:
> Hi, even it´s not in the review period yet, I´d like to highlight that 
> in the eIDAS regulation, article 19, indicated what Qualified and 
> non-qualified TSPs, so that means all CAs,

Presumably that actually means "all CAs based in Europe, plus all other CAs who want to offer qualified certificates"?

>  So, I´m not against of the goal of this proposal but as an EU CA I´m 
> not developing two procedures for the same issue, so I´d like to have 
> the option to just have one and use it, and inform the CABF, the 
> browsers or whoever using the same procedure and if possible, the same 
> tool.

It seems to me that the proposal does not really specify what system you use, only that one output be an email, which does not seem like too great a burden.

Gerv