[Servercert-wg] [EXTERNAL] SC48 and case sensitivity of CN and SAN value encoding

[Mike Reilly (SECURITY)]

@Ryan Sleevi<mailto:rsleevi at chromium.org> will this position by Google Chrome to considered such certificates to be mis-issued be applicable for certs issued by Private (Managed/Enterprise) CAs as well?  I do understand that this forum is for public CAs but if Chrome is enforcing this in its browser, then like CT, it won't work for Private CAs.  Since there is a setting provided by Chrome for CT for private CAs, will there eventually be the same capability for this scenario for private CAs?   Thanks, Mike

From: Servercert-wg <servercert-wg-bounces at cabforum.org> On Behalf Of Corey Bonnell via Servercert-wg
Sent: Friday, August 6, 2021 5:45 AM
To: CA/B Forum Server Certificate WG Public Discussion List <servercert-wg at cabforum.org>
Subject: [EXTERNAL] [Servercert-wg] SC48 and case sensitivity of CN and SAN value encoding

Hello,
A question on the GitHub PR for SC48 [1] pointed out that the language surrounding acceptable encoding of CN values is not clear whether case mismatches of the SAN dNSName and CN value are allowed. The conclusion of that discussion is that at least one Root Program will view such case mismatches as mis-issuance. It appears that there may be several CAs impacted by this, so I wanted to alert the group in case this is unexpected for those CAs.

Thanks,
Corey

[1] https://github.com/cabforum/servercert/pull/285#discussion_r683444000<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcabforum%2Fservercert%2Fpull%2F285%23discussion_r683444000&data=04%7C01%7CMike.reilly%40microsoft.com%7C8d9598cdff7a47b6241a08d958d8122f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637638507321117907%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=2UJb%2F00k66QOp%2B83EKvf%2FqZ5TtP1gFy6HHPAy6W9LE0%3D&reserved=0>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20210809/362090b9/attachment.html>