[Servercert-wg] Final Minutes for Server Certificate Working Group Teleconference - March 5, 2020

[Dimitris Zacharopoulos (HARICA)]

These are the Final Minutes of the Teleconference described in the 
subject of this message.*
*


    Attendees (in alphabetical order)

Adam Clark (Visa), Bruce Morton (Entrust Datacard), Clint Wilson 
(Apple), Corey Bonnell (SecureTrust), Chris Kemmerer (SSL.com), Curt 
Spann (Apple), Daniela Hood (GoDaddy), Dean Coclin (Digicert), Dimitris 
Zacharopoulos (HARICA), Doug Beattie (GlobalSign), Dustin Hollenback 
(Microsoft), Enrico Entschew (D-TRUST), Eva Vansteenberge (GlobalSign), 
Inaba Atsushi (GlobalSign), India Donald (US Federal PKI Management 
Authority), Janet Hines (SecureTrust), Joanna Fox (GoDaddy), Kirk Hall 
(Entrust Datacard), Li-Chun Chen (Chunghwa Telecom), Michelle Coon 
(OATI), Mike Reilly (Microsoft), Neil Dunbar (TrustCor Systems), Niko 
Carpenter (SecureTrust), Peter Miskovic (Disig), Rich Smith (Sectigo), 
Robin Alden (Sectigo), Ryan Sleevi (Google), Shelley Brewer (Digicert), 
Sissel Hoel (Buypass AS), Timo Schmitt (SwissSign), Tobias Josefowitz 
(Opera Software AS), Trevoli Ponds-White (Amazon), Wayne Thayer 
(Mozilla), Wendy Brown (US Federal PKI Management Authority).


    Minutes


      1. Roll Call

The Chair took attendance.


      2. Read Antitrust Statement

The Antitrust Statement was read.


      3. Review Agenda

Accepted without changes.


      4. Validation Subcommittee Update

The subcommittee's call had follow-ups from the F2F including 7 work items.

  * Default-deny interpretation of the BRs and discussion about a ballot
    to clarify subjectDN in CA Certificates. Ryan has offered to draft a
    ballot for that.
  * List of Registration/Incorporation Agencies for the Jurisdiction of
    Incorporation information and how to maintain this list. Proposal to
    require CAs to disclose a list without trying to restrict usage, and
    see in practice which agencies are being used. Ryan has already
    proposed a draft ballot to the validation subcommittee mailing list.
  * CA semantics to limit issuance to DV/OV/IV/EV Certificates
  * OU field requirements. We need to agree on the purpose of adding
    information into this field. Robin agreed to offer a proposal for
    this topic.
  * LEI in subjectDN fields. Tim is working on a ballot.
  * Standardising stateOrProvince names. Some CAs reported that there
    are standards with good information for several cases. Some areas
    are more difficult than others. The collection of
    Registration/Incorporation Agencies for Jurisdiction of
    Incorporation might help with this task as well.
  * Default-deny: Doug created a copy of the BRs in a GoogleDoc with a
    goal to mark areas where "default-deny" causes problems. This
    document will allow anyone to add comments. The Subcommittee
    encourages everyone to add comments to this document and highlight
    areas of concern.
  * The SC will review specific places for "default-deny", starting with
    section 7.1 (Certificate Profiles) as a first target. This
    particular topic will be discussed on the next SC call.

The draft minutes of that particular Validation SubCommittee meeting are 
available in 
https://cabforum.org/pipermail/validation/2020-March/001417.html


      5. NetSec Subcommittee Update

There was no meeting after the F2F. Neil mentioned that they will need 
to change ballot number (SC20 has failed automatically) and include OS 
patches in the new ballot.

There are 3 ballots on their way to the main Working Group.


      6. Ballot Status


        _Ballots in Discussion Period_

/SC20: Configuration Management/ (Neil)
No further discussion
//////
_*Ballots in Voting Period*_
////None

_*Ballots in Review Period*_
/SC27: Version 3 Onion Certificates /(Wayne) (review ends 2020-03-26)//


        _Draft Ballots under Consideration_


/SC26 - Pandoc-Friendly Markdown Formatting Changes/ (Jos)
Ryan and Jos to work on a ballot for SC26. Ryan explained that Jos' 
ballot "touches" a lot of sections of the BRs and it is very likely that 
new ballots might "touch" the same sections as SC26. In such cases, the 
ballot proposer must include language to describe how these specific 
sections will look like should SC26 pass or fail. If anyone wants to 
propose a ballot while SC26 is in the official discussion period, Ryan 
may assist any proposer with drafting the appropriate language to make 
progress in parallel. There is no need for a "quiet" period until SC26 
completes its processing cycle.

//LEI Ballot//(Tim H.)/
/No updates./

Aligning the BRs with existing Browser Requirements /(Ryan)
Browser members have already reviewed a newer version. Ryan is waiting 
for a last review from Microsoft due to some new Root Program 
requirements related to the revocation reasons for CA Certificates being 
revoked. He is also adding OCSP/CRL profiles and Mozilla Requirements 
for Key Usage.
This ballot will need review by several Members. He expects discussions 
to take place for the selection of effective dates because some Root 
Programs have been selectively enforcing requirements. There will be 
concerns for effective dates or where some new requirements came from.

The latest copy will be circulated soon. Ryan mentioned that he doesn't 
want to rush this ballot through and will be flexible on effective dates.


      7. Minutes for F2F 49

Dimitris mentioned that the majority of the draft minutes have been 
uploaded on the wiki. He emailed the minute-takers of the last 3 slots.


      8. Any Other Business

No other Business raised.


      9. Next call

March 19, 2020 at 11:00 am Eastern Time.


      Adjourned


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/servercert-wg/attachments/20200320/ea41c9a3/attachment-0001.html>