[Servercert-wg] Discussion Period Begins | SC-079 - Allow more than one Certificate Policy in a Cross-Certified Subordinate CA Certificate

[Corey Bonnell]

Sorry, case of the Fridays. The comment is pending because I didn't submit
the review yet (so no one could see it). I went ahead and did that now.

 

From: Servercert-wg <servercert-wg-bounces at cabforum.org> On Behalf Of Corey
Bonnell via Servercert-wg
Sent: Friday, September 20, 2024 11:36 AM
To: Paul van Brouwershaven <Paul.vanBrouwershaven at entrust.com>; CA/B Forum
Server Certificate WG Public Discussion List <servercert-wg at cabforum.org>
Subject: Re: [Servercert-wg] Discussion Period Begins | SC-079 - Allow more
than one Certificate Policy in a Cross-Certified Subordinate CA Certificate

 

I commented on the Github PR last week, but the comment is still pending:
the first sentence of 7.1.2.2.6 should be changed to remove "If present", as
cross certificates must always include the certificatePolicies extension.
The "if present" stipulation was originally added to address the Root CA
certificate case, where the omission of the certificatePolicies extension is
encouraged.

 

Thanks,

Corey

 

From: Servercert-wg <servercert-wg-bounces at cabforum.org
<mailto:servercert-wg-bounces at cabforum.org> > On Behalf Of Paul van
Brouwershaven via Servercert-wg
Sent: Friday, September 20, 2024 4:03 AM
To: CA/B Forum Server Certificate WG Public Discussion List
<servercert-wg at cabforum.org <mailto:servercert-wg at cabforum.org> >
Subject: [Servercert-wg] Discussion Period Begins | SC-079 - Allow more than
one Certificate Policy in a Cross-Certified Subordinate CA Certificate

 

### Purpose of the Ballot

 

This ballot duplicates the content of section 7.1.2.10.5 (CA Certificate
Certificate Policies) into section 7.1.2.2 (Cross-Certified Subordinate CA
Certificate Profile) as section 7.1.2.2.6 (Cross-Certified Subordinate CA
Certificate Certificate Policies), modifying the requirement from "MUST
contain exactly one Reserved Certificate Policy Identifier" to "MUST include
at least one Reserved Certificate Policy Identifier. If any Subscriber
Certificates will chain up directly to the Certificate issued under this
Certificate Profile, this Cross-Certified Subordinate CA Certificate MUST
contain exactly one Reserved Certificate Policy Identifier". This change
allows the inclusion of multiple Reserved Certificate Policy Identifiers in
a Cross-Certified Subordinate CA Certificate, except when any Subscriber
Certificates chain up directly to the Certificate issued under this
Certificate Profile.

 

Additionally, the description of the `policyIdentifier` contents was updated
for clarification in both sections.

 

The following motion has been proposed by Paul van Brouwershaven (Entrust)
and endorsed by Ben Wilson (Mozilla) and Thomas Zermeno (SSL.com).

 

GitHub pull request for this ballot:
https://github.com/cabforum/servercert/pull/544 

 

### Motion begins

 

MODIFY the "Baseline Requirements for the Issuance and Management of
Publicly-Trusted TLS Server Certificates" ("TLS Baseline Requirements")
based on Version 2.0.7 as specified in the following redline:

 

-
https://github.com/cabforum/servercert/compare/ba28d04894d69c8fac62850b9d0de
5061658c7c5...20ac9adc0f9620f5b361c96c1041404432e7fa47 

 

### Motion ends

 

This ballot proposes a Final Maintenance Guideline. The procedure for
approval of this ballot is as follows:

 

Discussion (7+ days)

 

- Start time: 2024-09-20 08:00 UTC

- End time: 2024-09-27 08:00 UTC

 

Vote for approval (7 days)

 

- Start time: TBC

- End time: TBC

Any email and files/attachments transmitted with it are intended solely for
the use of the individual or entity to whom they are addressed. If this
message has been sent to you in error, you must not copy, distribute or
disclose of the information it contains. Please notify Entrust immediately
and delete the message from your system. 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20240920/d904f2ad/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5231 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/servercert-wg/attachments/20240920/d904f2ad/attachment-0001.p7s>