[cabf_validation] Proposed ballot - EV State Optional
陳立群
realsky at cht.com.tw
Thu Dec 22 04:26:38 MST 2016
Dear All,
For SSL BR V1.4.1, I forgot to combine Ben’s and Wen-Cheng’s
suggestions to amend 7.1.4.2.2 e. Sorry, at the busy time of the end of
2016.
I suggest more persons who involves or involved the development of
Government CAs or directory services to discuss below proposals.
So the amendment of 7.1.4.2.2 e & f will be
7.1.4.2.2 Subject Distinguished Name Fields
f.Certificate Field: subject:stateOrProvinceName (OID: 2.5.4.8)
Required if the subject:organizationName field, subject:givenName field, or
subject:surname field are present and subject:localityName field is absent.
Optional if: (a) the subject:localityName field and the
subject:organizationName field, and subject:givenName field , or
subject:surname field are present.
t, or (b) if the country name provided under subsection h. is Taiwan (TW),
Singapore (SG), etc..
or (c) if the subject:organizationName and subject:countryName fields are
present and the country/jurisdiction specified by the subject:countryName
field has a centralized registry for that kind of organizations so that the
organization name specified by the subject:organizationName field is
"unique" in the entire country/jurisdiction.
Normally, situation (c) may exist in small countries/jurisdictions such as
Singapore (SG), Taiwan (TW), etc
7.1.4.2.2 Subject Distinguished Name Fields
f.Certificate Field: subject:stateOrProvinceName (OID: 2.5.4.8)
Required if the subject:organizationName field, subject:givenName field, or
subject:surname field are present and subject:localityName field is absent.
Optional if: (a) the subject:localityName field and the
subject:organizationName field, and subject:givenName field , or
subject:surname field are present.
t, or (b) if the country name provided under subsection h. is Taiwan (TW),
Singapore (SG), etc..
or (c) if the subject:organizationName and subject:countryName fields are
present and the country/jurisdiction specified by the subject:countryName
field has a centralized registry for that kind of organizations so that the
organization name specified by the subject:organizationName field is
"unique" in the entire country/jurisdiction.
Normally, situation (c) may exist in small countries/jurisdictions such as
Singapore (SG), Taiwan (TW), etc.
Reasons:
(1).For small countries/jurisdictions, if they do not set up any state or
province. Some CAs misplaced absence or false province or state name.
(2).The organizationName is already unique at the country level, such as a
company in Taiwan.
(Please see attached file page 5 to 7 about the company act in Taiwan.
Also our government has a QGIS for coppanies)
(3) More flexible to resolve government PKI already have their naming form
that can distinguish Subject unambiguously.
For example, In US FPKI,
C=US, o=U.S. Government, [ou=department], [ou=agency],
[ou=structural_container], cn=device name
Or see attached file page 15 to page 17.
About reasons (2) & (3), please see attached file page 4 to page 14.
Also please see attached file page 18 to page 19 that
The minimal set of Subject info for legal person in Electronic Signatures
and Infrastructures (ESI); Certificate Profiles; Part 3: Certificate profile
for certificates issued to legal persons are
4.2.1 Subject
The subject field shall include at least the following attributes as
specified in Recommendation ITU-T X.520 [1]:
‧ countryName;
‧ organizationName;
‧ organizationIdentifier; and
‧ commonName.
So I think if there are no state or province in some places in EU, or
there is a centralized registry for some organizations in that place, then
the Subject Name of a OV SSL certificate can be
C=xx
O=XX organization
CN=FQDN of XX organization
If you want to compare 7.1.4.2.2 e.f. before and after proposed
version ,please see tables in attached file page 25 & 26.
Sincerely Yours,
Li-Chun Chen
From: 陳立群 [mailto:realsky at cht.com.tw]
Sent: Monday, December 19, 2016 6:01 PM
To: 'CA/Browser Forum Validation WG List'; 'Bruce Morton'
Cc: 'Kirk Hall'
Subject: Re: [cabf_validation] Proposed ballot - EV State Optional
Refer to SSL BR V1.4.1,
If we change the BR to
7.1.4.2.2 Subject Distinguished Name Fields
f.Certificate Field: subject:stateOrProvinceName (OID: 2.5.4.8)
Required if the subject:organizationName field, subject:givenName field, or
subject:surname field are present and subject:localityName field is absent.
Optional if: (a) the subject:localityName field and the
subject:organizationName field, and subject:givenName field , or
subject:surname field are present.
t, or (b) if the country name provided under subsection h. is Taiwan (TW),
Singapore (SG), etc..
or (c) if the subject:organizationName and subject:countryName fields are
present and the country/jurisdiction specified by the subject:countryName
field has a centralized registry for that kind of organizations so that the
organization name specified by the subject:organizationName field is
"unique" in the entire country/jurisdiction.
Normally, situation (c) may exist in small countries/jurisdictions such as
Singapore (SG), Taiwan (TW), etc.
(b) and (c) are exception for original sentences.
We need not to maintain “Appendix X“, just let the Licensed WebTrust
Practitioners : International to check the suitability for DN rule for each
CA. So there will be no burden for maintain the list in CA/B forum.
And then we amend EVGL section 9.2.5 and 9.2.7, with some reference to
SSL BR 7.1.4.2.2.
The reason is that Taiwan’s government already has DN naming (GPKI
certificate and CRL profile, DN tree, Government Directory Service) for 13
years.
it is not suitable to enforce the CA to insert either L or ST into the
subject DN as page 23 and 24 of attached file.
Li-Chun Chen
From: Validation [mailto:validation-bounces at cabforum.org] On Behalf Of Kirk
Hall via Validation
Sent: Friday, December 16, 2016 2:35 AM
To: CA/Browser Forum Validation WG List; Bruce Morton
Cc: Kirk Hall
Subject: [外部郵件] Re: [cabf_validation] Proposed ballot - EV State
Optional
Another possibility is to leave state or province as required, but then add:
“State or province is not required for the countries listed on Appendix X”
Then we add places (Taiwan, Monaco, Vatican City, Germany, United Kingdom)
as people bring them forward. We could include an initial list with this
ballot to avoid having to prepare another ballot to add places.
From: Validation [mailto:validation-bounces at cabforum.org] On Behalf Of Tim
Hollebeek via Validation
Sent: Thursday, December 15, 2016 10:26 AM
To: Bruce Morton <Bruce.Morton at entrustdatacard.com>; CA/Browser Forum
Validation WG List <validation at cabforum.org>
Cc: Tim Hollebeek <THollebeek at trustwave.com>
Subject: Re: [cabf_validation] Proposed ballot - EV State Optional
Yes, I like something along those lines.
From: Bruce Morton [mailto:Bruce.Morton at entrustdatacard.com]
Sent: Thursday, December 15, 2016 1:25 PM
To: Tim Hollebeek; CA/Browser Forum Validation WG List
Subject: RE: Proposed ballot - EV State Optional
How about this?
Required/Optional:
City and country – Required;
State – Required, if verified per Section 11.4.1 as part of the address for
the Place of Business;
Street and postal code – Optional
If there is no state or the state is not used as part of the address, then
it is not required.
Bruce.
From: Tim Hollebeek [mailto:THollebeek at trustwave.com]
Sent: Thursday, December 15, 2016 10:19 AM
To: CA/Browser Forum Validation WG List <validation at cabforum.org>
Cc: Bruce Morton <Bruce.Morton at entrustdatacard.com>
Subject: RE: Proposed ballot - EV State Optional
But City + Country is not unique in many common, important cases
(“Springfield, United States”), and the state is also important since
state laws tend to vary quite a bit in the US … I think something more in
the spirit of the current BRs that does a better job of tightening up what
“where applicable” means would be better.
I don’t want to lose the requirement that US EV certificates MUST include
the state.
-Tim
From: Validation [mailto:validation-bounces at cabforum.org] On Behalf Of Bruce
Morton via Validation
Sent: Thursday, December 15, 2016 9:28 AM
To: CA/Browser Forum Validation WG List
Cc: Bruce Morton
Subject: [cabf_validation] Proposed ballot - EV State Optional
Here is a proposed ballot per my action.
Thanks, Bruce.
Background:
There is confusion on whether the state or province OID MUST be included in
an EV certificate. EV section 9.2.7 states in one place “State or province
(where applicable)” and also “City, state and country – Required.”
Since many countries do not have states or provinces and some that do have
states or provinces do not use them for their address, it is proposed that
inclusion of the state or province OID should be optional.
-- MOTION BEGINS --
Current section 9.2.7 of EV Guidelines:
Required/Optional: City, state, and country – Required; Street and postal
code – Optional
Proposed section 9.2.7 of EV Guidelines:
Required/Optional: City and country – Required; Street, state and postal
code – Optional
-- MOTION ENDS --
The review period for this ballot shall commence at 2200 UTC on XX, and will
close at 2200 UTC on XX. Unless the motion is withdrawn during the review
period, the voting period will start immediately thereafter and will close
at 2200 UTC on XX. Votes must be cast by posting an on-list reply to this
thread.
A vote in favor of the motion must indicate a clear 'yes' in the response. A
vote against must indicate a clear 'no' in the response. A vote to abstain
must indicate a clear 'abstain' in the response. Unclear responses will not
be counted. The latest vote received from any representative of a voting
member before the close of the voting period will be counted. Voting members
are listed here:
<https://scanmail.trustwave.com/?c=4062&d=8t_S2CLG1RJ6XptDB9PCkT6EtPLjV0eNXV
qfzYQ53A&s=5&u=https%3a%2f%2fcabforum%2eorg%2fmembers%2f>
https://cabforum.org/members/
In order for the motion to be adopted, two thirds or more of the votes cast
by members in the CA category and greater than 50% of the votes cast by
members in the browser category must be in favor. Quorum is currently nine
(9) members– at least nine members must participate in the ballot, either
by voting in favor, voting against, or abstaining.
_____
This transmission may contain information that is privileged, confidential,
and/or exempt from disclosure under applicable law. If you are not the
intended recipient, you are hereby notified that any disclosure, copying,
distribution, or use of the information contained herein (including any
reliance thereon) is strictly prohibited. If you received this transmission
in error, please immediately contact the sender and destroy the material in
its entirety, whether in electronic or hard copy format.
_____
This transmission may contain information that is privileged, confidential,
and/or exempt from disclosure under applicable law. If you are not the
intended recipient, you are hereby notified that any disclosure, copying,
distribution, or use of the information contained herein (including any
reliance thereon) is strictly prohibited. If you received this transmission
in error, please immediately contact the sender and destroy the material in
its entirety, whether in electronic or hard copy format.
本信件可能包含中華電信股份有限公司機密資訊,非指定之收件者,請勿蒐集、處理或利用本信件內容,並請銷毀此信件. 如為指定收件者,應確實保護郵件中本公司之營業機密及個人資料,不得任意傳佈或揭露,並應自行確認本郵件之附檔與超連結之安全性,以共同善盡資訊安全與個資保護責任.
Please be advised that this email message (including any attachments) contains confidential information and may be legally privileged. If you are not the intended recipient, please destroy this message and all attachments from your system and do not further collect, process, or use them. Chunghwa Telecom and all its subsidiaries and associated companies shall not be liable for the improper or incomplete transmission of the information contained in this email nor for any delay in its receipt or damage to your system. If you are the intended recipient, please protect the confidential and/or personal information contained in this email with due care. Any unauthorized use, disclosure or distribution of this message in whole or in part is strictly prohibited. Also, please self-inspect attachments and hyperlinks contained in this email to ensure the information security and to protect personal information.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://cabforum.org/pipermail/validation/attachments/20161222/b8476bd0/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Chunghwatelecom-revised20161222.pdf
Type: application/pdf
Size: 868644 bytes
Desc: not available
URL: <http://cabforum.org/pipermail/validation/attachments/20161222/b8476bd0/attachment-0001.pdf>
More information about the Validation
mailing list