[Smcwg-public] Ballot SMC01: Final Guideline for “S/MIME Baseline Requirements”

[Dimitris Zacharopoulos (HARICA)]

On 29/9/2022 12:40 μ.μ., Pedro FUENTES via Smcwg-public wrote:
> Hi there,
> I was just thinking on the discussion yesterday about the Country, and 
> the issue detected about the “Subject being validated” (and included 
> in the certificate) to be the country where the company is registered 
> (and I said “registered” because I understood there were opinions 
> saying that this field would be redundant as we had already the 
> organisation identifier, which is related to the country of registration).
>
> Although we follow already this practice, so currently for MPKI 
> customers we include the country of the company, as verified, this has 
> recurrently annoyed some customers that have employees in different 
> locations (sometimes changing the state/province, not necessarily the 
> country), so maybe this deserves some discussion.
>
> My first question would be… is there really consensus about setting 
> the country as the country (and state, if present) where the company 
> is registered? The current writing of the guidelines talks about the 
> “Country of the Subject”, so until now it could be understood that 
> this was about the person, not the company… I heard some discordant 
> voices and for me wasn’t clear the general opinion.
>
> My second question would be… could we specify in the certificate the 
> country where the company “operates”, instead of the country where is 
> registered? My rational for this question is as follows: Same as in 
> the BR for SSL, it’s required to be done a “validation of physical 
> existence”, and this could eventually allow to include in the 
> certificate dutifully validated countries (or states) where the 
> company operates, and not necessarily the country where the company is 
> registered… This in fact opens up a possibility… Could it be 
> understood that the company operates where the employee that gets the 
> certificate is located?

My reading of the requirements is that ANY countryName value where the 
country is registered or operates (this needs to be validated of course) 
is acceptable.

>
> My third question… once there’s intent to take the BR for SSL as 
> reference… what about the obligation to include the state/province and 
> country if the organisation name is present? Was this discussed? 
> (maybe I missed that call)

Only the countryName was discussed to be added as a SHALL. I believe the 
logic is the same for ST and L. They need to follow the organization for 
the sponsored profile, not the individual.

Cheers,
Dimitris.

>
> Best,
> Pedro
>
> *WISeKey SA
> *
> *Pedro Fuentes
> *CSO - Trust Services Manager
> Office: + 41 (0) 22 594 30 00
> Mobile: + 41 (0) 791 274 790
> Address: Avenue Louis-Casaï 58 | 1216 Cointrin | Switzerland
> *Stay connected with WISeKey <http://www.wisekey.com>
> *
> *THIS IS A TRUSTED MAIL*: This message is digitally signed with a 
> WISeKey identity. If you get a mail from WISeKey please check 
> the signature to avoid security risks
>
> *CONFIDENTIALITY: *This email and any files transmitted with it can be 
> confidential and it’s intended solely for the use of the individual or 
> entity to which they are addressed. If you are not the named addressee 
> you should not disseminate, distribute or copy this e-mail. If 
> you have received this email in error please notify the sender
>
> *DISCLAIMER: *WISeKey does not warrant the accuracy or completeness of 
> this message and does not accept any liability for any errors or 
> omissions herein as this message has been transmitted over a public 
> network. Internet communications cannot be guaranteed to be secure or 
> error-free as information may be intercepted, corrupted, or contain 
> viruses. Attachments to this e-mail are checked for viruses; 
> however, we do not accept any liability for any damage sustained by 
> viruses and therefore you are kindly requested to check for viruses 
> upon receipt.
>
>
> _______________________________________________
> Smcwg-public mailing list
> Smcwg-public at cabforum.org
> https://lists.cabforum.org/mailman/listinfo/smcwg-public
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/smcwg-public/attachments/20220929/152e7f82/attachment.html>