[cabfpub] Concerns regarding Mozilla Root Program/Baseline Requirements

[kirk_hall at trendmicro.com]

Just because you (and others) may have had an *undisclosed* expectation about something, and I (and others) had an opposite *undisclosed* expectation about the same thing relating to initial adoption of the BRs doesn’t make any of us liars.

In the future, if anyone thinks some new CA/Browser Forum requirement is meant to be retroactive (i.e., will apply to certificates already issued or to agreements made before the effective date of the new requirement) – please speak up, as that’s a big expectation to have, and many may oppose it.

I can say that the only explicit requirement included in the initial BRs about maximum validity period for certs is BR 9.4 – and by its terms, it clearly does not apply to certs issued or agreements made before the effective date of the BRs.

I can also say that in the future, Trend Micro is likely to oppose any new requirements that are explicitly intended to be retroactive and would require a CA to revoke outstanding certs and/or breach existing agreements with customers, unless there is an extraordinary, proven, and immediate security threat – and the issue currently under current discussion doesn’t meet that test.

From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org] On Behalf Of Eddy Nigg (StartCom Ltd.)
Sent: Tuesday, August 06, 2013 2:51 PM
To: public at cabforum.org >> public at cabforum.org
Subject: Re: [cabfpub] Concerns regarding Mozilla Root Program/Baseline Requirements


On 08/07/2013 12:43 AM, From kirk_hall at trendmicro.com:<mailto:kirk_hall at trendmicro.com:>
Ryan and Eddy – if it was anyone’s intention to put CAs in the position of breach of contract with their existing customers for long-term certificates they had issued pre-BR (by effectively prohibiting them under the BRs from reissuing an existing long term cert for the balance of the cert validity period, as the CAs had agreed to do with their customers by contract), that was never made clear by anyone.

Well, as I mentioned earlier, if you are in this situation then fire your lawyers and whoever is responsible for setting up the policies and agreements. But there are other possible solutions to make a customer happy and still stay in compliance with the BR, I don't have to mention those here.


If it had been made clear, I doubt many CAs would have supported that position.  We don’t think that’s a common-sense interpretation of the current BRs.

In my opinion it's the only logical interpretation and not only that, but we've discussed this extensively and the current BR was created by consensus being fully aware of the implications. Claiming otherwise would be a lie.

Regards



Signer:

Eddy Nigg, COO/CTO



StartCom Ltd.<http://www.startcom.org>

XMPP:

startcom at startcom.org<xmpp:startcom at startcom.org>

Blog:

Join the Revolution!<http://blog.startcom.org>

Twitter:

Follow Me<http://twitter.com/eddy_nigg>





<table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential 
and may be subject to copyright or other intellectual property protection. 
If you are not the intended recipient, you are not authorized to use or 
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20130807/3c9d31f9/attachment-0003.html>