[cabfpub] Ballot 190

[Jeremy Rowley]

Sorry – that was pretty confusing.  I revised the questions in way that I think answers most of your question:

1.	If we include the validation WG proposed language in Section 3.2.2.4, does that adequately address the concerns with the previous version of ballot 190?
2.	If there are still concerns, should we drop the reuse language altogether? Note that this will require revalidation of all information prior to issuance of new certificates if the original validation was not in accordance with one of these ten sections.
3.	If we add the language to Section 3.2.2.4, would you vote against the ballot because of the document reuse?
4.	If the reuse language proposed was dropped altogether and re-validation became required, would you vote against the ballot?
5.	If you’d vote against the ballot, is there some middle ground that we can reach? For example, could we say that all previous validation information not complaint with the 10 methods must expire 13 months from the date of the ballot? Alternatively, everything under section 7 expires immediately while documents affected by a modification to 1-6 will remain valid for 825 days? Other proposals.

Basically, we’re at an impasse on the ballot, and I’m not sure which way the vote would go.

 

A couple of comments:

 

“I think the general language proposal is a bit awkward - I would rather see it pegged to an explicit minimum version (for example, BRs 1.4.1) and explicitly forbid using a previous "any other method" validation. Is that problematic?”

 

This seems reasonable to me, but I’ll let others chime in.

 

“I think if we're still unable to agree on a timeline such as that - requiring revalidation consistent with the current-3.2.2.4 for anything that was validated under a previous-3.2.2.4 that is no longer permitted - my only other suggestion would be to require an explicit expression within the certificate that it complies with the current version of 3.2.2.4 at the time of issuance. This would help give Relying Parties the necessary assurances that the CA is committed to security.”

 

This seems reasonable to me as well.

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20170427/b4d2cdb4/attachment-0003.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4964 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/public/attachments/20170427/b4d2cdb4/attachment-0001.p7s>