[Servercert-wg] Servercert-wg Digest, Vol 44, Issue 13

[Peter Miškovič]

Disig votes "YES" on Ballot SC51: Reduce and Clarify Audit Log  and Records Archival Retention Requirements.

Regards
Peter Miskovic



-----Original Message-----
From: Servercert-wg <servercert-wg-bounces at cabforum.org> On Behalf Of servercert-wg-request at cabforum.org
Sent: Saturday, February 19, 2022 1:00 PM
To: servercert-wg at cabforum.org
Subject: Servercert-wg Digest, Vol 44, Issue 13

Send Servercert-wg mailing list submissions to
        servercert-wg at cabforum.org

To subscribe or unsubscribe via the World Wide Web, visit
        https://lists.cabforum.org/mailman/listinfo/servercert-wg
or, via email, send a message with subject or body 'help' to
        servercert-wg-request at cabforum.org

You can reach the person managing the list at
        servercert-wg-owner at cabforum.org

When replying, please edit your Subject line so it is more specific than "Re: Contents of Servercert-wg digest..."


Today's Topics:

   1. Voting period for Ballot SC51: Reduce and Clarify Audit Log
      and Records Archival Retention Requirements (Clint Wilson)


----------------------------------------------------------------------

Message: 1
Date: Fri, 18 Feb 2022 14:01:04 -0800
From: Clint Wilson <clintw at apple.com>
To: ServerCert CA/BF <servercert-wg at cabforum.org>
Subject: [Servercert-wg] Voting period for Ballot SC51: Reduce and
        Clarify Audit Log and Records Archival Retention Requirements
Message-ID: <06C26A2D-A978-49C8-9739-27A26732E497 at apple.com>
Content-Type: text/plain; charset="utf-8"

This email begins the Voting period for Ballot SC51: Reduce and Clarify Audit Log and Records Archival Retention Requirements

BALLOT SC51: Reduce and Clarify Audit Log and Records Archival Retention Requirements

PURPOSE OF BALLOT

The purpose of this ballot is to consolidate and clarify aspects of audit log and records archival retention expectations and time-periods within 5.5.2.

Foremost, this ballot reduces retention periods for records archival to 2 years.
Further, currently audit log events as outlined in section 5.4.1, and then referenced in 5.4.3 lead to confusion around the log retention that is defined and exclusive to each section, and how that retention feeds into records archival requirements. To further clarify the objectives of that interaction, an explicit requirement has been introduced in 5.5.1 stating that CAs must archive lifecycle event records.

As minor adjustments to related requirements, this ballot also clarifies what is expected by the term ?OCSP Entries? as a logged lifecycle event; as OCSP Entry is an undefined term, this was replaced with OCSP Response such that it should be clear that a CA will be logging the event of signing an OCSP Response (including the elements stipulated in 5.4.1). Similarly, some certificate lifecycle events expected to be retained are currently separated into 5.5.2; these have been incorporated into 5.4.1 instead. This ballot also explicitly calls out the need for delegated third parties to abide by the established retention periods for audit logging and records archival procedures.
This ballot also formalizes incorporation of terms defined in the NCSSRs as also applying to the BRs.

MOTION

The following motion has been proposed by Clint Wilson of Apple and endorsed by Trevoli Ponds-White of Amazon and Dustin Hollenback of Microsoft.

-----Motion Begins-----

This ballot modifies the ?Baseline Requirements for the Issuance and Management of Publicly-Trusted Certificates? as defined in the following redline, based on Version 1.8.1:

https://github.com/cabforum/servercert/compare/65e80e07855ecc1d2264c040ecc7d398f997d2c5...2281a6c78692c3444db9a162df4ff217014b9f1f <https://github.com/cabforum/servercert/compare/65e80e07855ecc1d2264c040ecc7d398f997d2c5...2281a6c78692c3444db9a162df4ff217014b9f1f>

-----Motion Ends-----

This ballot proposes a Final Maintenance Guideline. The procedure for approval of this ballot is as follows:

Discussion (7+ days)

Start Time: February 11 2022 21:00 UTC
End Time: February 18 2022 21:00 UTC

Vote for approval (7 days)

Start Time: February 18 2022 22:00 UTC
End Time: February 25 2022 22:00 UTC
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20220218/768c5369/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3621 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20220218/768c5369/attachment-0001.p7s>

------------------------------

Subject: Digest Footer

_______________________________________________
Servercert-wg mailing list
Servercert-wg at cabforum.org
https://lists.cabforum.org/mailman/listinfo/servercert-wg


------------------------------

End of Servercert-wg Digest, Vol 44, Issue 13
*********************************************