[cabfpub] Ballot 161 - Notification of incorrect issuance

Sun Jan 31 14:40:34 UTC 2016

Hi Jeremy,

I might agree that the state of reporting will not be perfect, even 
after this ballot. However, I believe it will improve things 
significantly, and it will do so right away. I think a small improvement 
today is still good, even though a larger one might appear some time in 
the future.

A CA should have at most a few cases of misissuance. There is then no 
need to create a formal reporting mechanism. If it happens, write it up 
(which should be done internally already), and put it out there. Whether 
as a blog post, a .pdf or an Excel sheet doesn't matter. There is very 
little extra work going into this from a CA.

If a CA does have a lot of misissuances, this will be significant work. 
But the CA should then work on their procedures instead, to get down to 
at most a few cases. This is work that ought to happen in any case.

Thus in neither case do I see this ballot as introducing any significant 
additional work on a CA.

As for CT, Opera is also in favour of this. But currently CT is only 
supported by one browser, and only for EV certificates. It will likely 
take years at best before everybody can agree on a single policy for all 
certificates, and this policy then needs to be implemented into all new 
browsers. Until all browsers in use have the new implementation, CT 
reporting does not protect all users - misissued certificates without CT 
will still be considered valid by older browsers. Considering that 
Windows XP was launched in 2001 and is still in significant use, you may 
add another 15 years before CT reporting can be relied on by itself. 
This ballot would thus serve a significant purpose in the next 20 years.

We do not see this ballot and CT as mutually exclusive, we see both as 
independently advantageous for securing end users.

On 30.01.2016 22:41, Jeremy Rowley wrote:
> We have some reservations about this ballot, although they are not identical to Doug's. Instead, we see this ballot as fairly duplicative of the efforts already invested in Certificate Transparency.  Creating another reporting mechanism, when we've just recently had everyone implement CT, seems like a waste of resources that would be better spent on moving towards mandatory logging of all certificates. We'd much rather see a ballot that accelerates CT adoption over these more ambiguous reporting requirements.  If every cert is logged, the monitors can easily parse the information for relevant BR/EV compliance.
>
> -----Original Message-----
> From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org] On Behalf Of Doug Beattie
> Sent: Friday, January 29, 2016 11:54 AM
> To: Sigbjørn Vik; public at cabforum.org
> Subject: Re: [cabfpub] Ballot 161 - Notification of incorrect issuance
>
> GlobalSign has some serious reservations about this ballot.  I've sent this comment previously, but I'll send it again now that we are in the formal comment period.
>
> I feel strongly that the CABF, as a standards forum, should be focused on improving security and defining strong standards, but that compliance is a completely different responsibility.  We have WebTrust for CA auditors and root programs which do this today. We don’t want the BRs to encompass the WT for CAs audit requirements.   If the Root store operators and/or WT want to define compliance monitoring standards/initiatives that's fine, but I'm against CABF levying compliance reporting requirements.
>
> Doug Beattie
>
> -----Original Message-----
> From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org] On Behalf Of Sigbjørn Vik
> Sent: Friday, January 29, 2016 3:32 AM
> To: public at cabforum.org
> Subject: [cabfpub] Ballot 161 - Notification of incorrect issuance
>
> Ballot 161 - Notification of incorrect issuance
>
> Based on extensive discussions in the forum, Sigbjørn Vik from Opera proposes the following ballot, endorsed by Ryan Sleevi from Google and Gervase Markham from Mozilla.
>
> -- MOTION BEGINS --
>
> The following text is added as a sub-section to section 2.2 of the Baseline Requirements:
>
> 2.2.1 Notification of incorrect issuance
>
> In the event that a CA issues a certificate in violation of these requirements, the CA SHALL publicly disclose a report within one week of becoming aware of the violation. A link to the report SHALL simultaneously be sent to incidents at cabforum.org.
>
> Effective 01-Jul-16, the CA SHALL in its Certificate Policy and/or Certification Practice Statement announce where such reports will be found. The location SHALL be as accessible as the CP/CPS.
>
> The report SHALL publicize details about what the error was, what caused the error, time of issuance and discovery, and public certificates for all issuer certificates in the trust chain.
>
> The report SHALL publicize the full public certificate, with the following exception: For certificates issued prior to 01-Mar-16 the report MAY truncate Subject Distinguished Name fields and subjectAltName extension values to the registerable domain name.
>
> The report SHALL be made available to the CAs Qualified Auditor for the next Audit Report.
>
> -- MOTION ENDS --
>
> The review period for this ballot shall commence at 2300 UTC on 29 January 2016, and will close at 2300 UTC on 5 February 2016. Unless the motion is withdrawn during the review period, the voting period will start immediately thereafter and will close at 2300 UTC on 12 February 2016. Votes must be cast by posting an on-list reply to this thread.
>
> A vote in favor of the motion must indicate a clear 'yes' in the response. A vote against must indicate a clear 'no' in the response. A vote to abstain must indicate a clear 'abstain' in the response. Unclear responses will not be counted. The latest vote received from any representative of a voting member before the close of the voting period will be counted. Voting members are listed here:
> https://cabforum.org/members/
>
> In order for the motion to be adopted, two thirds or more of the votes cast by members in the CA category and greater than 50% of the votes cast by members in the browser category must be in favor. Quorum is currently nine (9) members– at least nine members must participate in the ballot, either by voting in favor, voting against, or abstaining.
>
> --
> Sigbjørn Vik
> Opera Software
> _______________________________________________
> Public mailing list
> Public at cabforum.org
> https://cabforum.org/mailman/listinfo/public
>

-- 
Sigbjørn Vik
Opera Software