[Servercert-wg] [EXTERNAL] SC48 and case sensitivity of CN and SAN value encoding

[Ryan Sleevi]

Hey Mike,

I'm not fully sure I understand the question. Are you asking "Will Chrome
enforce the Baseline Requirements on locally-trusted CAs"?

I think you can see that the respective root programs, of all the browser
members, have taken such situations on a case-by-case basis; for example, I
believe Apple was the vendor who most recently introduced such changes (
https://support.apple.com/en-us/HT210176 )

But they generally haven't had any bearing to the discussions in the CA/B
Forum regarding the adoption or interpretation of existing requirements.

That is, I should hope to say it's uncontroversial to say a certificate
that doesn't comply with the BRs, issued by a CA subject to the BRs, is
misissuance, regardless of how an application treats it. Similarly, I think
it's uncontroversial to point out that our respective applications may
reject certificates that are not misissuance, or may make distinction
between BR-subjected CA issuance and non-BR-subjected CA issuance.

The comparison to CT doesn't really make sense, because that's not a BR
requirement. The language of "character by character copy" is very much a
part of the BRs (at least, post IP review). While it doesn't really seem
relevant to the Forum, on the Chrome side, we've haven't really offered
enterprise policies to "ignore the BRs from CAs subject to the BRs", and I
doubt that's likely to change anytime soon.

On Mon, Aug 9, 2021 at 2:46 PM Mike Reilly (SECURITY) <
Mike.Reilly at microsoft.com> wrote:

> @Ryan Sleevi <rsleevi at chromium.org> will this position by Google Chrome
> to considered such certificates to be mis-issued be applicable for certs
> issued by Private (Managed/Enterprise) CAs as well?  I do understand that
> this forum is for public CAs but if Chrome is enforcing this in its
> browser, then like CT, it won’t work for Private CAs.  Since there is a
> setting provided by Chrome for CT for private CAs, will there eventually be
> the same capability for this scenario for private CAs?   Thanks, Mike
>
>
>
> *From:* Servercert-wg <servercert-wg-bounces at cabforum.org> *On Behalf Of *Corey
> Bonnell via Servercert-wg
> *Sent:* Friday, August 6, 2021 5:45 AM
> *To:* CA/B Forum Server Certificate WG Public Discussion List <
> servercert-wg at cabforum.org>
> *Subject:* [EXTERNAL] [Servercert-wg] SC48 and case sensitivity of CN and
> SAN value encoding
>
>
>
> Hello,
>
> A question on the GitHub PR for SC48 [1] pointed out that the language
> surrounding acceptable encoding of CN values is not clear whether case
> mismatches of the SAN dNSName and CN value are allowed. The conclusion of
> that discussion is that at least one Root Program will view such case
> mismatches as mis-issuance. It appears that there may be several CAs
> impacted by this, so I wanted to alert the group in case this is unexpected
> for those CAs.
>
>
>
> Thanks,
>
> Corey
>
>
>
> [1] https://github.com/cabforum/servercert/pull/285#discussion_r683444000
> <https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcabforum%2Fservercert%2Fpull%2F285%23discussion_r683444000&data=04%7C01%7CMike.reilly%40microsoft.com%7C8d9598cdff7a47b6241a08d958d8122f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637638507321117907%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=2UJb%2F00k66QOp%2B83EKvf%2FqZ5TtP1gFy6HHPAy6W9LE0%3D&reserved=0>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20210809/3d56b781/attachment.html>