[Servercert-wg] Discussion Period Begins: Ballot SC-061v3: New CRL Entries must have a Revocation Reason Code

Wed Feb 1 17:45:34 UTC 2023

Superseded for these 2 reasons doesn't seem appropriate unless you also add
that a new certificate was issued or at least requested, as a replacement.

6. The Certificate no longer complies with the requirements of [Section
6.1.5](#615-key-sizes) and [Section
6.1.6](#616-public-key-parameters-generation-and-quality-checking)
(CRLReason #4, superseded);
and
12. The CA is made aware that the Certificate was not issued in accordance
with these Requirements or the CA's Certificate Policy or Certification
Practice Statement (CRLReason #4, superseded);

The definition isn't clear that a new cert has been issued (or even
requested) based on the highlighted text - was it supposed to say that the
CA issued a replacement certificate because it has reasonable evidence
....? Or should it just have ended with a . before the ", or the CA has ..."

  * **superseded (RFC 5280 CRLReason #4):** Indicates that the Certificate
Subscriber has requested a new Certificate to replace an existing
Certificate, or the CA has reasonable evidence that the validation of
domain authorization or control for any fully‐qualified domain name or IP
address in the Certificate should not be relied upon or the CA has revoked
the Certificate for compliance reasons such as the Certificate does not
comply with these Baseline Requirements or the CA's CP or CPS;

Thanks,

Wendy

Wendy Brown

Supporting GSA

FPKIMA Technical Liaison

Protiviti Government Services
703-965-2990 (cell)

On Wed, Feb 1, 2023 at 12:22 PM Aaron Gable via Servercert-wg <
servercert-wg at cabforum.org> wrote:

> Wonderful, thank you! I have no further comments.
>
> Aaron
>
> On Tue, Jan 31, 2023 at 4:08 PM Ben Wilson <bwilson at mozilla.com> wrote:
>
>> Thanks, Aaron - the numbering change was unintentional, so I fixed that,
>> and I made other changes as requested.  See
>>
>> https://github.com/BenWilson-Mozilla/servercert/commit/f1ed2357c6c9fe9bcedaec040582f872e0f519de
>> <https://github.com/BenWilson-Mozilla/servercert/commit/f1ed2357c6c9fe9bcedaec040582f872e0f519de>
>> Before I re-announce the discussion period, does anyone else have other
>> changes that they would like to see?
>> Thanks,
>> Ben
>>
>> On Mon, Jan 30, 2023 at 9:58 AM Aaron Gable <aaron at letsencrypt.org>
>> wrote:
>>
>>> The current redline appears to undo the recent renumbering of section
>>> 4.9.1.1, causing it to have two different instances of paragraphs 1 through
>>> 5. These were renumbered in Ballot SC-56 Cleanup[1]. Can we please preserve
>>> the new numbering?
>>>
>>> Additional notes:
>>> - In 4.1.1.1 (1), perhaps "without specifying a CRLReason", rather than
>>> "without giving a reason"? A Subscriber might state "Please revoke this
>>> because I accidentally deleted the keys", in which case they are giving a
>>> reason, but the best revocation reason is still 0 (Unspecified). One might
>>> believe that Superseded is applicable in this case, but that revocation
>>> request does not necessarily indicate that the Subscriber has also replaced
>>> the certificate.
>>> - A very minor comment, but there's inconsistent phrasing between the
>>> five revocation reasons in Section 7.2.2: the first begins "Indicates
>>> that..." while the others begin "It is intended to be used...". Can we give
>>> all five of these entries the same structure/phrasing?
>>>
>>> Aaron
>>>
>>> [1]
>>> https://github.com/cabforum/servercert/pull/401/files#diff-e0ac1bd190515a4f2ec09139d395ef6a8c7e9e5b612957c1f5a2dea80c6a6cfeR1214-R1224
>>>
>>> On Thu, Jan 19, 2023 at 1:55 PM Ben Wilson via Servercert-wg <
>>> servercert-wg at cabforum.org> wrote:
>>>
>>>> All,
>>>>
>>>> This is version 3 of Ballot SC-061. I've moved some of the language
>>>> down into section 7.2.2, and I've added back in two paragraphs that have
>>>> been in the original Mozilla Root Store Policy regarding changing the
>>>> reason code and revocation date for key compromise.  I also changed the
>>>> compliance date to July 15, 2023. (The compliance date for CAs in Mozilla's
>>>> program was Oct. 1, 2022.)
>>>>
>>>> *Purpose of Ballot SC-061 v.3*
>>>>
>>>> The purpose of this ballot is to modify sections 4.9.1.1 and 7.2.2 of
>>>> the Baseline Requirements to incorporate the CRL reason codes that Mozilla
>>>> has adopted in section 6.1.1 of the Mozilla Root Store Policy.
>>>>
>>>> *Motion*
>>>>
>>>>
>>>> The following motion has been proposed by Ben Wilson of Mozilla and
>>>> endorsed by David Kluge of Google Trust Services and Kiran Tummala of
>>>> Microsoft.
>>>>
>>>> *—–Motion Begins—–*
>>>>
>>>> This ballot modifies sections 4.9.1.1 and 7.2.2 of the “Baseline
>>>> Requirements for the Issuance and Management of Publicly-Trusted
>>>> Certificates” as defined in the following redline, based on Version 1.8.6:
>>>>
>>>>
>>>> https://github.com/cabforum/servercert/compare/2c63814fa7f9f7c477c74a6bfbeb57e0fcc5dd5b..b1a3d9b491c9744a50a0e194678d76c639d6076b
>>>>
>>>>
>>>>  *—–Motion Ends—–*
>>>>
>>>> This ballot proposes a Final Maintenance Guideline. The procedure for
>>>> approval of this ballot is as follows:
>>>>
>>>> Discussion (7+ days)
>>>>
>>>> Start Time:  January 19, 2023 22:00 UTC
>>>>
>>>> End Time: January 26, 2023 22:00 UTC
>>>>
>>>>
>>>>
>>>> Vote for approval (7 days)
>>>>
>>>> Start Time:  January 26, 2023 TBD
>>>>
>>>> End Time: February 2, 2023 TBD
>>>> _______________________________________________
>>>> Servercert-wg mailing list
>>>> Servercert-wg at cabforum.org
>>>> https://lists.cabforum.org/mailman/listinfo/servercert-wg
>>>>
>>> _______________________________________________
> Servercert-wg mailing list
> Servercert-wg at cabforum.org
> https://lists.cabforum.org/mailman/listinfo/servercert-wg
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20230201/8128aba0/attachment-0001.html>