[Servercert-wg] Voting Ends Soon on Ballot SC30v2: Disclosure of
realsky at cht.com.tw
Mon Jul 13 07:01:46 MST 2020
Chunghwa Telecom votes YES on Ballot SC30v2.
From: Servercert-wg <servercert-wg-bounces at cabforum.org> On Behalf Of Wayne Thayer via Servercert-wg
Sent: Monday, July 13, 2020 4:00 AM
To: CA/B Forum Server Certificate WG Public Discussion List <servercert-wg at cabforum.org>
Subject: [外部郵件] [Servercert-wg] Voting Ends Soon on Ballot SC30v2: Disclosure of Registration / Incorporating Agency
Reminder: Voting ends Monday 13-July 2020 at 20:00 UTC on Ballot SC30v2: Disclosure of Registration / Incorporating Agency
On Mon, Jul 6, 2020 at 7:21 AM Ryan Sleevi via Servercert-wg <mailto:servercert-wg at cabforum.org> wrote:
This begins the voting period for Ballot SC30v2: Disclosure of Registration / Incorporating Agency
Purpose of Ballot:
The EV Guidelines aim to ensure a consistent and repeatable level of validation for certificates, regardless of the CA performing the validation, providing Relying Parties consistency for all certificates complying with these Guidelines. Although the Guidelines attempt to specify objective requirements, areas remain that rely on a subjective determination by the CA. One such area is determining whether a given Incorporating Agency or Registration Agency fulfills these Requirements.
As currently specified, it's possible for one CA to make a determination that a given Registration Agency or Incorporating Agency does meet the requirements of the EV Guidelines, while a different CA determines that same Agency does not. As the reliability of the information validated within the Certificate is tied to the reliability of the data source used to verify this information, this inconsistency undermines the assurance that EV Certificates are meant to provide.
While there is utility in being able to identify precisely what datasource(s) were used with a given Certificate, this ballot does not involve such work. It merely seeks to ensure that, for any given Organization, it can be validated consistently and to the same degree, regardless of the CA, by working to achieve consistency among all CAs in their selection of data sources.
Much like the work to remove “Any other method” from the validation of domain names, ensuring consistency, transparency, and objectivity in validating domain names, this ballot is the first step to doing the same for organization information.
A potential roadmap of ballots to to address these issues involves:
• CAs publish the list of Registration Agencies / Incorporating Agencies they use (this ballot)
• Create an allowed list of Registration Agencies / Incorporating Agencies and associated values, along with a process for updating and adding new ones, and requiring issuance exclusively use Agencies on this list.
• If useful and relevant to Relying Parties, ensure each Certificate can be tied back to their Registration Agency / Incorporating Agency, such as disclosure within the Certificate itself, so they can unambiguously and uniquely determine the organization that has been validated.
A similar process may then be repeated for other forms of verification data sources, such as the QIIS, QTIS, and QGIS within the EV Guidelines, or the Reliable Data Sources within the Baseline Requirements.
This was originally drafted in https://github.com/sleevi/cabforum-docs/pull/11 , and as a pull request is available at https://github.com/cabforum/documents/pull/194
The difference between v1 of this ballot and v2 has been to modify the language to be clearer for those where English is not the first/primary language. The redline between v1 and v2 is available at https://github.com/cabforum/documents/pull/194/commits/4e8f16f16bf7ec92d9509976e843099091e4b5b7
The following motion has been proposed by Ryan Sleevi of Google and endorsed by Ben Wilson of Mozilla and Dimitris Zacharopoulos of HARICA.
— MOTION BEGINS —
This ballot modifies the “Guidelines for the Issuance and Management of Extended Validation Certificates” (“EV Guidelines”) as follows, based on version 1.7.2:
ADD a paragraph to Section 9.2.4 of the EV Guidelines as defined in the following redline: https://github.com/cabforum/documents/compare/d5067bbbfb46906c65e476ef3d55dd3b2c505a09..4e8f16f16bf7ec92d9509976e843099091e4b5b7
ADD a paragraph to Section 9.2.5 of the EV Guidelines as defined in the following redline: https://github.com/cabforum/documents/compare/d5067bbbfb46906c65e476ef3d55dd3b2c505a09..4e8f16f16bf7ec92d9509976e843099091e4b5b7
ADD a Section 11.1.3 to the EV Guidelines as defined in the following redline: https://github.com/cabforum/documents/compare/d5067bbbfb46906c65e476ef3d55dd3b2c505a09..4e8f16f16bf7ec92d9509976e843099091e4b5b7
The Chair or Vice-Chair is permitted to update the Relevant Dates of the EV Guidelines as appropriate, such as in the following redline: https://github.com/cabforum/documents/compare/d5067bbbfb46906c65e476ef3d55dd3b2c505a09..4e8f16f16bf7ec92d9509976e843099091e4b5b7
— MOTION ENDS —
This ballot proposes a Final Maintenance Guideline.
The procedure for approval of this ballot is as follows:
Discussion (7+ days)
Start Time: 26-June 2020 19:00 UTC
End Time: after 4-July 2020 00:00 UTC
Vote for approval (7 days)
Start Time: 6-July 2020 14:20 UTC
End Time: 13-July 2020 20:00 UTC
Servercert-wg mailing list
mailto:Servercert-wg at cabforum.org
Please be advised that this email message (including any attachments) contains confidential information and may be legally privileged. If you are not the intended recipient, please destroy this message and all attachments from your system and do not further collect, process, or use them. Chunghwa Telecom and all its subsidiaries and associated companies shall not be liable for the improper or incomplete transmission of the information contained in this email nor for any delay in its receipt or damage to your system. If you are the intended recipient, please protect the confidential and/or personal information contained in this email with due care. Any unauthorized use, disclosure or distribution of this message in whole or in part is strictly prohibited. Also, please self-inspect attachments and hyperlinks contained in this email to ensure the information security and to protect personal information.
More information about the Servercert-wg