[cabfpub] [EXTERNAL]Re: Ballot 190 - Recording BR Version Number

Wayne Thayer wthayer at godaddy.com
Wed Aug 2 00:24:39 UTC 2017


Yes - It would be up to the author of the ballot to increment the version number when a material change is made to any of the methods.

From: Kirk Hall <Kirk.Hall at entrustdatacard.com>
Date: Tuesday, August 1, 2017 at 4:54 PM
To: Wayne Thayer <wthayer at godaddy.com>, Ben Wilson <ben.wilson at digicert.com>, CA/Browser Forum Public Discussion List <public at cabforum.org>, Gervase Markham <gerv at mozilla.org>
Subject: RE: [cabfpub] [EXTERNAL]Re: Ballot 190 - Recording BR Version Number

So Wayne, if a change is made to Method 8 only by a ballot, once effective would the text be changed to “VERSION 2 OF”?  Then, later, if changes are made to Methods 2, 3, and 4 by a single ballot, the text would be changed to “VERSION 3 OF”, etc.?

That is certainly a simpler solution than I had understood (and is right in the substantive BR 3.2.2.4 language itself), and I can see the value of it.

From: Wayne Thayer [mailto:wthayer at godaddy.com]
Sent: Tuesday, August 1, 2017 3:39 PM
To: Ben Wilson <ben.wilson at digicert.com>; CA/Browser Forum Public Discussion List <public at cabforum.org>; Gervase Markham <gerv at mozilla.org>; Kirk Hall <Kirk.Hall at entrustdatacard.com>
Subject: Re: [cabfpub] [EXTERNAL]Re: Ballot 190 - Recording BR Version Number

Ben – here’s a simple approach to versioning the entire section with changes in ALL CAPS:

3.2.2.4. Validation of Domain Authorization or Control
This section defines VERSION 1 OF the permitted processes and procedures for validating the Applicant's ownership or control of the domain.
The CA SHALL confirm that, as of the date the Certificate issues, either the CA or a Delegated Third Party has validated each Fully‐Qualified Domain Name (FQDN) listed in the Certificate using at least one of the methods listed below.
Completed confirmations of Applicant authority may be valid for the issuance of multiple certificates over time. In all cases, the confirmation must have been initiated within the time period specified in the relevant requirement (such as Section 3.3.1 of this document) prior to certificate issuance. For purposes of domain validation, the term Applicant includes the Applicant's Parent Company, Subsidiary Company, or Affiliate.

[WT] the following sentence is added by ballot 190:

CAs SHALL maintain a record of which domain validation method, INCLUDING RELEVANT VERSION NUMBER OF THE PERMITTED PROCESSES AND PROCEDURES FOR VALIDATING THE APPLICANT’S OWNERSHIP OR CONTROL OF THE DOMAIN, they used to validate every domain.

Note: FQDNs may be listed in Subscriber Certificates using dNSNames in the subjectAltName extension or in Subordinate CA Certificates via dNSNames in permittedSubtrees within the Name Constraints extension.


From: Ben Wilson <ben.wilson at digicert.com<mailto:ben.wilson at digicert.com>>
Date: Tuesday, August 1, 2017 at 3:15 PM
To: Wayne Thayer <wthayer at godaddy.com<mailto:wthayer at godaddy.com>>, CA/Browser Forum Public Discussion List <public at cabforum.org<mailto:public at cabforum.org>>, Gervase Markham <gerv at mozilla.org<mailto:gerv at mozilla.org>>, Kirk Hall <Kirk.Hall at entrustdatacard.com<mailto:Kirk.Hall at entrustdatacard.com>>
Subject: RE: [cabfpub] [EXTERNAL]Re: Ballot 190 - Recording BR Version Number

Wayne,
Can you give an example of what embedding would look like?
Thanks,
Ben
________________________________
From: Wayne Thayer<mailto:wthayer at godaddy.com>
Sent: ‎8/‎1/‎2017 3:58 PM
To: Ben Wilson<mailto:ben.wilson at digicert.com>; CA/Browser Forum Public Discussion List<mailto:public at cabforum.org>; Gervase Markham<mailto:gerv at mozilla.org>; Kirk Hall<mailto:Kirk.Hall at entrustdatacard.com>
Subject: Re: [cabfpub] [EXTERNAL]Re: Ballot 190 - Recording BR Version Number
The original concern I raised was with the ballot 190 requirement that CAs begin to log the BR version number associated with the validation method used on each request. My concerns are:
1. The BR version doesn’t clearly indicate when a validation method has changed. As has been stated, the BR version number will surely increment for many reasons unrelated to validation methods. BR version 1.8.3 is likely to have the same meaning as version 2.1.6 in terms of validation methods.
2. CAs will review changes to the validation methods and come to different conclusions as to what changes require the BR version number to be incremented in their logs. Is a wording change material, even though I’m not updating the code? The ballot author should decide this.
3. CAs generally need to implement changes to methods prior to a BR version number even being assigned. I closely review ballots, but I don’t track BR version numbers.

This led me to propose a version number embedded in section 3.2.2.4 of the BRs that covers either all validation methods or one for each method – it doesn’t matter to me. This approach:
1. Provides clear guidance that the CA must update the version number they’re logging as part of implementing a particular change
2. 2. Allows CAs to make changes based on approved ballots rather than being dependent on BR version numbers
3. Doesn’t require a separate section of the BRs to be updated and kept in synch
4. Can easily be added to ballot 190 while we’re waiting for ballot 202

Thanks,

Wayne


On 8/1/17, 9:28 AM, "Public on behalf of Ben Wilson via Public" <public-bounces at cabforum.org on behalf of public at cabforum.org<mailto:public-bounces at cabforum.org%20on%20behalf%20of%20public at cabforum.org>> wrote:

    There are two sides to this - one is with the CAs, where they record what
    method was used, and the other is at the CA/Browser Forum level, where someone
    maintains a chart, or whatever, of validation methods in effect, and
    historically which ones were effective during which periods.


    -----Original Message-----
    From: Gervase Markham [mailto:gerv at mozilla.org]
    Sent: Tuesday, August 1, 2017 10:06 AM
    To: Ben Wilson <ben.wilson at digicert.com<mailto:ben.wilson at digicert.com>>; CA/Browser Forum Public Discussion
    List <public at cabforum.org<mailto:public at cabforum.org>>; Kirk Hall <Kirk.Hall at entrustdatacard.com<mailto:Kirk.Hall at entrustdatacard.com>>
    Subject: Re: [cabfpub] [EXTERNAL]Re: Ballot 190 - Recording BR Version Number

    On 01/08/17 17:00, Ben Wilson wrote:
    > Are we talking about what the CA records in its database for the
    > validation method used, or are we talking about annotating the BRs
    > with a record of when a change was made?

    I am raising the problem that if there is a list of changes made and it goes
    out of sync with reality, then what do I, at Mozilla, do if a CA says "well, I
    didn't realise that change had been made because it wasn't added to the
    official list"?

    There should be one and exactly one method of knowing when changes are made.

    Earlier, although perhaps not in this thread, someone suggested independent
    version numbers for each of the methods. That has a similar issue - there
    should be one and exactly one method of recording what validation method was
    used.

    Gerv

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20170802/22366130/attachment-0003.html>


More information about the Public mailing list