[Servercert-wg] [EXTERNAL] SC48 and case sensitivity of CN and SAN value encoding

[Mike Reilly (SECURITY)]

Thanks Ryan.   You've answered my questions and your responses are aligned to my expectations for our trusted CAs.  I had some questions come up related to your comments in GitHub on this ballot so I posted here to ensure clarity for folks.  Thanks, Mike

From: Ryan Sleevi <rsleevi at chromium.org>
Sent: Monday, August 9, 2021 11:54 AM
To: Mike Reilly (SECURITY) <Mike.Reilly at microsoft.com>
Cc: CA/B Forum Server Certificate WG Public Discussion List <servercert-wg at cabforum.org>; Ryan Sleevi <rsleevi at chromium.org>; Corey Bonnell <Corey.Bonnell at digicert.com>
Subject: Re: [EXTERNAL] [Servercert-wg] SC48 and case sensitivity of CN and SAN value encoding

You don't often get email from rsleevi at chromium.org<mailto:rsleevi at chromium.org>. Learn why this is important<http://aka.ms/LearnAboutSenderIdentification>
Hey Mike,

I'm not fully sure I understand the question. Are you asking "Will Chrome enforce the Baseline Requirements on locally-trusted CAs"?

I think you can see that the respective root programs, of all the browser members, have taken such situations on a case-by-case basis; for example, I believe Apple was the vendor who most recently introduced such changes ( https://support.apple.com/en-us/HT210176<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsupport.apple.com%2Fen-us%2FHT210176&data=04%7C01%7CMike.Reilly%40microsoft.com%7C5120be373344425829c808d95b6711a3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637641320510556051%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=hhnZSvmBU3FD5LfQpsjGT9UPE2e1LBby78in7kiMeF8%3D&reserved=0> )

But they generally haven't had any bearing to the discussions in the CA/B Forum regarding the adoption or interpretation of existing requirements.

That is, I should hope to say it's uncontroversial to say a certificate that doesn't comply with the BRs, issued by a CA subject to the BRs, is misissuance, regardless of how an application treats it. Similarly, I think it's uncontroversial to point out that our respective applications may reject certificates that are not misissuance, or may make distinction between BR-subjected CA issuance and non-BR-subjected CA issuance.

The comparison to CT doesn't really make sense, because that's not a BR requirement. The language of "character by character copy" is very much a part of the BRs (at least, post IP review). While it doesn't really seem relevant to the Forum, on the Chrome side, we've haven't really offered enterprise policies to "ignore the BRs from CAs subject to the BRs", and I doubt that's likely to change anytime soon.

On Mon, Aug 9, 2021 at 2:46 PM Mike Reilly (SECURITY) <Mike.Reilly at microsoft.com<mailto:Mike.Reilly at microsoft.com>> wrote:
@Ryan Sleevi<mailto:rsleevi at chromium.org> will this position by Google Chrome to considered such certificates to be mis-issued be applicable for certs issued by Private (Managed/Enterprise) CAs as well?  I do understand that this forum is for public CAs but if Chrome is enforcing this in its browser, then like CT, it won't work for Private CAs.  Since there is a setting provided by Chrome for CT for private CAs, will there eventually be the same capability for this scenario for private CAs?   Thanks, Mike

From: Servercert-wg <servercert-wg-bounces at cabforum.org<mailto:servercert-wg-bounces at cabforum.org>> On Behalf Of Corey Bonnell via Servercert-wg
Sent: Friday, August 6, 2021 5:45 AM
To: CA/B Forum Server Certificate WG Public Discussion List <servercert-wg at cabforum.org<mailto:servercert-wg at cabforum.org>>
Subject: [EXTERNAL] [Servercert-wg] SC48 and case sensitivity of CN and SAN value encoding

Hello,
A question on the GitHub PR for SC48 [1] pointed out that the language surrounding acceptable encoding of CN values is not clear whether case mismatches of the SAN dNSName and CN value are allowed. The conclusion of that discussion is that at least one Root Program will view such case mismatches as mis-issuance. It appears that there may be several CAs impacted by this, so I wanted to alert the group in case this is unexpected for those CAs.

Thanks,
Corey

[1] https://github.com/cabforum/servercert/pull/285#discussion_r683444000<https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2Fcabforum%2Fservercert%2Fpull%2F285%23discussion_r683444000&data=04%7C01%7CMike.Reilly%40microsoft.com%7C5120be373344425829c808d95b6711a3%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637641320510566039%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=acBs11Xk4ILS1Gjwr3auZpXyf%2BjFVfCe8lpudpTFtcw%3D&reserved=0>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20210809/55db8d24/attachment-0001.html>