[cabfpub] Ballot proposal - Update Section 8.4 for CA audit criteria

Tim Hollebeek tim.hollebeek at digicert.com
Thu Apr 19 16:35:14 UTC 2018


Might as well fix all the audit references while we’re at it …

 

-Tim

 

From: Public [mailto:public-bounces at cabforum.org] On Behalf Of Jeff Ward via Public
Sent: Thursday, April 19, 2018 9:34 AM
To: Ryan Sleevi <sleevi at google.com>; CA/Browser Forum Public Discussion List <public at cabforum.org>; Dimitris Zacharopoulos <jimmy at it.auth.gr>
Subject: Re: [cabfpub] Ballot proposal - Update Section 8.4 for CA audit criteria

 

Not sure if it matters a great deal, but the reference to WebTrust for CA should be version 2.1, not 2.0.

 

Jeff Ward, CPA, CGMA, CITP, CISA, CISSP, CEH
Office Managing Partner & National Leader Third Party Attestation (SOC/WebTrust/Cybersecurity)
314-889-1220 (Direct)    347-1220 (Internal)
314-889-1221 (Fax)
 <mailto:jward at bdo.com> jward at bdo.com

BDO
101 S Hanley Rd, Suite 800
St. Louis, MO 63105 
UNITED STATES
314-889-1100
 <http://www.bdo.com> www.bdo.com

Please consider the environment before printing this e-mail

From: Public [mailto:public-bounces at cabforum.org] On Behalf Of Ryan Sleevi via Public
Sent: Monday, April 16, 2018 9:21 AM
To: Dimitris Zacharopoulos <jimmy at it.auth.gr <mailto:jimmy at it.auth.gr> >; CA/Browser Forum Public Discussion List <public at cabforum.org <mailto:public at cabforum.org> >
Subject: Re: [cabfpub] Ballot proposal - Update Section 8.4 for CA audit criteria

 

Attention: This email was sent from someone outside of BDO USA. Always use caution when opening attachments or clicking links from unknown senders or when receiving unexpected emails.

 

 

On Sun, Apr 15, 2018 at 2:18 AM, Dimitris Zacharopoulos via Public <public at cabforum.org <mailto:public at cabforum.org> > wrote:


I am looking for two endorsers for the following ballot.

Dimitris.

Ballot XXX - Update Section 8.4 for CA audit criteria 

The following motion has been proposed by Dimitris Zacharopoulos of HARICA and endorsed by ___ and ___

Background: 

Section 8.4 of the Baseline Requirements describes the audit criteria for CAs that issue Publicly-Trusted SSL/TLS Certificates. This ballot attempts to achieve two things: 

1.	Remove the old ETSI TS documents 
2.	Align the WebTrust <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.cabforum.org%2Fwiki%2FWebTrust&data=02%7C01%7Cjward%40bdo.com%7Cefc0815200a54f92dbf908d5a3a571a5%7C6e57fc1a413e405091da7d2dc8543e3c%7C0%7C0%7C636594853327607164&sdata=8xxyL5y4ru1ryYPo35ybbZcRfoYyoFJqbSNpNNqgDZE%3D&reserved=0>  and ETSI requirements 

"WebTrust <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.cabforum.org%2Fwiki%2FWebTrust&data=02%7C01%7Cjward%40bdo.com%7Cefc0815200a54f92dbf908d5a3a571a5%7C6e57fc1a413e405091da7d2dc8543e3c%7C0%7C0%7C636594853327607164&sdata=8xxyL5y4ru1ryYPo35ybbZcRfoYyoFJqbSNpNNqgDZE%3D&reserved=0>  for Certification Authorities" is equivalent to "ETSI EN 319 401" and "WebTrust <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.cabforum.org%2Fwiki%2FWebTrust&data=02%7C01%7Cjward%40bdo.com%7Cefc0815200a54f92dbf908d5a3a571a5%7C6e57fc1a413e405091da7d2dc8543e3c%7C0%7C0%7C636594853327607164&sdata=8xxyL5y4ru1ryYPo35ybbZcRfoYyoFJqbSNpNNqgDZE%3D&reserved=0>  Principles and Criteria for Certification Authorities – SSL Baseline with Network Security" is the equivalent of "ETSI EN 319 411-1". 

-- MOTION BEGINS -- 

Replace the first two numbered items in section 8.4 of the Baseline Requirements from: 

1.	WebTrust <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.cabforum.org%2Fwiki%2FWebTrust&data=02%7C01%7Cjward%40bdo.com%7Cefc0815200a54f92dbf908d5a3a571a5%7C6e57fc1a413e405091da7d2dc8543e3c%7C0%7C0%7C636594853327607164&sdata=8xxyL5y4ru1ryYPo35ybbZcRfoYyoFJqbSNpNNqgDZE%3D&reserved=0>  for Certification Authorities v2.0; 
2.	A national scheme that audits conformance to ETSI TS 102 042 / ETSI EN 319 411-1; or 

to: 

1.	WebTrust <https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.cabforum.org%2Fwiki%2FWebTrust&data=02%7C01%7Cjward%40bdo.com%7Cefc0815200a54f92dbf908d5a3a571a5%7C6e57fc1a413e405091da7d2dc8543e3c%7C0%7C0%7C636594853327763420&sdata=nF1OV4mtZ2VQF6ucGxisGOgndqhfDJYULFK4ZGNpOr4%3D&reserved=0>  Principles and Criteria for Certification Authorities – SSL Baseline with Network Security; 
2.	A national scheme that audits conformance to ETSI EN 319 411-1; or

 

As noted several times that this has come up in the past, your proposed change to #1 is meaningfully and substantially different than what is currently required. You are proposing *changing* the audit scheme to a more restrictive set. That's something in the past that browsers have objected to, and for good reason.



BDO USA, LLP, a Delaware limited liability partnership, is the U.S. member of BDO International Limited, a UK company limited by guarantee, and forms part of the international BDO network of independent member firms. 

BDO is the brand name for the BDO network and for each of the BDO Member Firms.

IMPORTANT NOTICES

The contents of this email and any attachments to it may contain privileged and confidential information from BDO USA, LLP. This information is only for the viewing or use of the intended recipient. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of, or the taking of any action in reliance upon, the information contained in this e-mail, or any of the attachments to this e-mail, is strictly prohibited and that this e-mail and all of the attachments to this e-mail, if any, must be immediately returned to BDO USA, LLP or destroyed and, in either case, this e-mail and all attachments to this e-mail must be immediately deleted from your computer without making any copies hereof. If you have received this e-mail in error, please notify BDO USA, LLP by e-mail immediately.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20180419/6cf018de/attachment-0003.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4940 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/public/attachments/20180419/6cf018de/attachment-0003.p7s>


More information about the Public mailing list