[cabfpub] Draft IV OID Ballot

Dean Coclin Dean_Coclin at symantec.com
Wed Jun 10 19:00:58 UTC 2015


 Rationale: When the optional OIDs were put into the BRs, we neglected to
create an OID for IV or Individual Verification. This would be for SSL certs
issued to individuals rather than formal organizations. This would still be
optional and just adds the new OID to the list.





Ballot 150-Addition of Optional OID for Individual Validation





The following motion has been proposed by Dean Coclin of Symantec and
endorsed by Jeremy Rowley of Digicert and Kirk Hall of Trend Micro



-- MOTION BEGINS -



Modify section 1.2 of Baseline Requirements as follows:



1.2 Document Name and Identification

This certificate policy (CP) contains the requirements for the issuance and
management of publicly‐trusted SSL certificates, as adopted by the
CA/Browser Forum.



The following Certificate Policy identifiers are reserved for use by CAs as
an optional means of asserting compliance with this CP (OID arc
2.23.140.1.2) as follows:



{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐ requirements(2) domain‐
validated(1)} (2.23.140.1.2.1);

{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐ requirements(2) organization
‐validated(2)} (2.23.140.1.2.2);  and

{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐ requirements(2) individual‐
validated(3)} (2.23.140.1.2.3).



Modify section 7.1.6.1 as follows:

7.1.6.1. Reserved Certificate Policy Identifiers

This section describes the content requirements for the Root CA, Subordinate
CA, and Subscriber Certificates, as they relate to the identification of
Certificate Policy.



The following Certificate Policy identifiers are reserved for use by CAs as
an optional means of asserting compliance with these Requirements as
follows:



{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐requirements(2) domain‐
validated(1)} (2.23.140.1.2.1), if the Certificate complies with these
Requirements but lacks Subject Identity Information that is verified in
accordance with either Section 3.2.2.1 or Section 3.2.3.



If the Certificate asserts the policy identifier of 2.23.140.1.2.1, then it
MUST NOT include organizationName, streetAddress, localityName,
stateOrProvinceName, or postalCode in the Subject field.



{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐requirements(2) organization‐
validated(2)} (2.23.140.1.2.2), if the Certificate complies with these
Requirements and includes Subject Identity Information that is verified in
accordance with Section 3.2.2.1.



{joint‐iso‐itu‐t(2) international‐organizations(23) ca‐browser‐
forum(140) certificate‐policies(1) baseline‐requirements(2) individual‐
validated(3)} (2.23.140.1.2.3), if the Certificate complies with these
Requirements and includes Subject Identity Information that is verified in
accordance with Section 3.2.3.



If the Certificate asserts the policy identifier of either 2.23.140.1.2.2 or
2.23.140.1.2.3, then it MUST also include organizationName, localityName,
stateOrProvinceName (if applicable), and countryName in the Subject field.



If the ballot passes, the custodian of the Forum OIDs will be instructed to
obtain the new OID for IV as indicated above.



-- MOTION ENDS -



The review period for this ballot shall commence at 2200 UTC on Thursday
June 11, 2015, and will close at 2200 UTC on Thursday 18 June 2015. Unless
the motion is withdrawn during the review period, the voting period will
start immediately thereafter and will close at 2200 UTC on Thursday, 25 June
2015. Votes must be cast by posting an on-list reply to this thread.

A vote in favor of the motion must indicate a clear 'yes' in the response. A
vote against must indicate a clear 'no' in the response. A vote to abstain
must indicate a clear 'abstain' in the response. Unclear responses will not
be counted. The latest vote received from any representative of a voting
member before the close of the voting period will be counted. Voting members
are listed here:  <https://cabforum.org/members/>
https://cabforum.org/members/



In order for the motion to be adopted, two thirds or more of the votes cast
by members in the CA category and greater than 50% of the votes cast by
members in the browser category must be in favor. Quorum is currently nine
(9) members- at least nine members must participate in the ballot, either by
voting in favor, voting against, or abstaining.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20150610/e7170a1e/attachment-0002.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5747 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/public/attachments/20150610/e7170a1e/attachment.p7s>


More information about the Public mailing list