[cabf_validation] Revision to OU requirements

[Ryan Sleevi]

I thought private CAs for AMT were supported since AMT 7.0, which was
circa-2010/2011 if I remember correctly?

Prior to that, Intel hard-coded a list of commercial CAs into the firmware
of their chips, which is just... many levels of "don't do that". On the
upside, it's possible to smoothly transition to new roots, for the
commercial CAs still wanting to provide those certificates, by spinning up
new roots, cross-signing new with old, issuing BR-compliant certs from new,
and withdrawing old from root stores (so they could issue non-BR compliant
certs). Basically, SHA-1 transition, but more structured, but I think that
should only matter for hardware more than 10 years old, and I think the old
stuff only supported SHA-1 anyways?

On Wed, Sep 2, 2020 at 4:53 PM Bruce Morton <
Bruce.Morton at entrustdatacard.com> wrote:

> Intel also uses the OU for Intel VPro/AMT use case where they require OU=
> Intel (R) Client Setup Certificate.
>
>
> https://www.intel.com/content/dam/support/us/en/documents/software/software-applications/Intel_SCS_Deployment_Guide.pdf
>
>
>
> Bruce.
>
>
>
> *From:* Validation <validation-bounces at cabforum.org> * On Behalf Of *Jeremy
> Rowley via Validation
> *Sent:* Wednesday, September 2, 2020 4:29 PM
> *To:* Ryan Sleevi <sleevi at google.com>
> *Cc:* CABforum3 <validation at cabforum.org>
> *Subject:* [EXTERNAL]Re: [cabf_validation] Revision to OU requirements
>
>
>
> *WARNING:* This email originated outside of Entrust Datacard.
> *DO NOT CLICK* links or attachments unless you trust the sender and know
> the content is safe.
> ------------------------------
>
> Yeah – we wanted to see what would happen if we turned it off. So far,
> there hasn’t been  a lot of noise. This is the first one we’ve encountered.
>
>
>
> VMware generate the OU as part of the cert request to create a unique
> identifier. The tool uses that unique identifier to do the installation.
> Removing the OU is breaking the VMware install tool and causing it not to
> load the certificate. We’re reaching out to them to see if we can get them
> to update their software and stop requiring OU.
>
>
>
> *From:* Ryan Sleevi <sleevi at google.com>
> *Sent:* Wednesday, September 2, 2020 2:23 PM
> *To:* Jeremy Rowley <jeremy.rowley at digicert.com>
> *Cc:* CABforum3 <validation at cabforum.org>; Richard Smith <rich at sectigo.com
> >
> *Subject:* Re: [cabf_validation] Revision to OU requirements
>
>
>
>
>
>
>
> On Wed, Sep 2, 2020 at 4:14 PM Jeremy Rowley <jeremy.rowley at digicert.com>
> wrote:
>
> We’ve been working to shut off OU completely to see if there are issues
> with doing so.  So far, we’ve found one automation tool that requires OU:
> https://kb.vmware.com/s/article/2044696
>
>
>
> Thanks Jeremy! I saw DigiCert was taking a good step here, in
> https://knowledge.digicert.com/alerts/ou-removal.html , and think that's
> a model for all CAs (by virtue of the BRs)
>
>
>
> I'm hoping you can share more details about the issue there. Are you
> saying the system doesn't load a publicly-trusted certificate if it's
> missing the OU field, or merely that their tool produces CSRs with the OU
> field populated, as part of ensuring a globally unique DN?
>
>
>
> Much like past work on working out interoperable, standards-based
> approaches to IP addresses (
> https://cabforum.org/guidance-ip-addresses-certificates/ ), it'd be great
> to understand the problem more to see what options we have.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/validation/attachments/20200902/6fa86d0a/attachment-0001.html>