[cabfpub] Ballot 189 (revised) - Amend Section 6.1.7 of Baseline Requirements

[Dimitris Zacharopoulos]

On 5/4/2017 1:39 μμ, García Jimeno, Oscar wrote:
>
> What happens with current time stamping certificates issued directly 
> by generic root CAs (that participates in a hierarchy that not only 
> issues PTC certificates). Must they be revoked in 30 days since this 
> ballot is approved?
>

This is mainly why there is an effective date in this ballot.

"These changes become Effective 30 days after the ballot passes."*

*It is not required to revoke such existing certificates but 30 days 
after the ballot passes, you must not use Root Keys to sign timestamping 
certificates.


Dimitris.*
*
>
> */.eus/**gara !*
>
> horregatik orain nire helbide elektronikoa da:
>
> por eso mi dirección de correo electrónico ahora es: 
> o-garcia at izenpe.eus <mailto:o-garcia at izenpe.eus>
>
> **
>
> *Oscar García*
>
> *CISSP, CISM*
>
> Descripción: Descripción: firma_email_Izenpe_eus
>
>
>
> ERNE! Baliteke mezu honen zatiren bat edo mezu osoa legez babestuta 
> egotea. Mezua badu bere hartzailea. Okerreko helbidera heldu bada 
> (helbidea gaizki idatzi, transmisioak huts egin) eman abisu igorleari, 
> korreo honi erantzuna. KONTUZ!
> ATENCION! Este mensaje contiene informacion privilegiada o 
> confidencial a la que solo tiene derecho a acceder el destinatario. Si 
> usted lo recibe por error le agradeceriamos que no hiciera uso de la 
> informacion y que se pusiese en contacto con el remitente.
>
> *De:*Public [mailto:public-bounces at cabforum.org] *En nombre de 
> *Dimitris Zacharopoulos via Public
> *Enviado el:* miércoles, 05 de abril de 2017 9:47
> *Para:* public at cabforum.org
> *CC:* Dimitris Zacharopoulos
> *Asunto:* [cabfpub] Ballot 189 (revised) - Amend Section 6.1.7 of 
> Baseline Requirements
>
>
> After the recent discussion, the ballot is now updated with simpler 
> language. Voting starts tomorrow April 6th.
>
> Dimitris.
>
> *Ballot 189 - Amend Section 6.1.7 of Baseline Requirements*
>
> The following motion has been proposed by Dimitris Zacharopoulos of 
> HARICA and endorsed by Bruce Morton of Entrust and Jeremy Rowley of 
> Digicert
>
> *Background*:
>
> Section 6.1.7 of the Baseline Requirements states that the Root CA 
> Private Keys MUST NOT be used to sign end-entity certificates, with 
> some exceptions. It is unclear if this exception list includes 
> end-entity certificates with EKU id-kp-timeStamping. This ballot 
> attempts to clarify two things:
>
>  1. that it affects Root Keys in a hierarchy that issues SSL
>     Certificates and
>  2. that it does not include time stamping certificates in the
>     exception list.
>
> It also clears the exception language for 1024-bit RSA Subscriber 
> Certificates and testing products with Certificates issued by a Root.
>
> *-- MOTION BEGINS --*
>
> /Current section 6.1.7/
>
> Root CA Private Keys MUST NOT be used to sign Certificates except in 
> the following cases:
>
>  1. Self-signed Certificates to represent the Root Certificate itself;
>  2. Certificates for Subordinate CAs and Cross Certificates;
>  3. Certificates for infrastructure purposes (e.g. administrative role
>     certificates, internal CA operational device certificates, and
>     OCSP Response verification Certificates);
>  4. Certificates issued solely for the purpose of testing products
>     with Certificates issued by a Root CA; and
>  5. Subscriber Certificates, provided that:
>
>      1. The Root CA uses a 1024-bit RSA signing key that was created
>         prior to the Effective Date;
>      2. The Applicant’s application was deployed prior to the
>         Effective Date;
>      3. The Applicant’s application is in active use by the Applicant
>         or the CA uses a documented process to establish that the
>         Certificate’s use is required by a substantial number of
>         Relying Parties;
>      4. The CA follows a documented process to determine that the
>         Applicant’s application poses no known security risks to
>         Relying Parties;
>      5. The CA documents that the Applicant’s application cannot be
>         patched or replaced without substantial economic outlay.
>      6. The CA signs the Subscriber Certificate on or before June 30,
>         2016; and
>      7. The notBefore field in the Subscriber Certificate has a date
>         on or before June 30, 2016
>
> /Proposed section 6.1.7/
>
> Private Keys corresponding to Root Certificates MUST NOT be used to 
> sign Certificates except in the following cases:
>
>  1. Self-signed Certificates to represent the Root CA itself;
>  2. Certificates for Subordinate CAs and Cross Certificates;
>  3. Certificates for infrastructure purposes (administrative role
>     certificates, internal CA operational device certificates)
>  4. Certificates for OCSP Response verification;
>
> *These changes become Effective 30 days after the ballot passes.*
>
> *-- MOTION ENDS --*
>
> The procedure for this ballot is as follows (exact start and end times 
> may be adjusted to comply with applicable Bylaws and IPR Agreement):
>
> BALLOT 189 Status: Amend BR 6.1.7
>
> 	
>
> Start time (22:00 UTC)
>
> 	
>
> End time (22:00 UTC)
>
> Discussion (7 days)
>
> 	
>
> 30 March 2017
>
> 	
>
> 6 April 2017
>
> Vote for approval (7 days)
>
> 	
>
> 6 April 2017
>
> 	
>
> 13 April 2017
>
> If vote approves ballot: Review Period (Chair to send Review Notice) 
> (30 days)
> If Exclusion Notice(s) filed, ballot approval is rescinded and PAG to 
> be created.
> If no Exclusion Notices filed, ballot becomes effective at end of 
> Review Period.
> Votes must be cast by posting an on-list reply to this thread on the 
> Public Mail List.
>
> 	
>
> Upon filing of Review Notice by Chair
>
> 	
>
> 30 days after filing of Review Notice by Chair
>
> From Bylaw 2.3: If the Draft Guideline Ballot is proposing a Final 
> Maintenance Guideline, such ballot will include a redline or 
> comparison showing the set of changes from the Final Guideline 
> section(s) intended to become a Final Maintenance Guideline, and need 
> not include a copy of the full set of guidelines. Such redline or 
> comparison shall be made against the Final Guideline section(s) as 
> they exist at the time a ballot is proposed, and need not take into 
> consideration other ballots that may be proposed subsequently, except 
> as provided in Bylaw Section 2.3(j).
>
> Votes must be cast by posting an on-list reply to this thread on the 
> Public list. A vote in favor of the motion must indicate a clear 'yes' 
> in the response. A vote against must indicate a clear 'no' in the 
> response. A vote to abstain must indicate a clear 'abstain' in the 
> response. Unclear responses will not be counted. The latest vote 
> received from any representative of a voting member before the close 
> of the voting period will be counted. Voting members are listed here: 
> https://cabforum.org/members/
>
> In order for the motion to be adopted, two thirds or more of the votes 
> cast by members in the CA category and greater than 50% of the votes 
> cast by members in the browser category must be in favor. Quorum is 
> shown on CA/Browser Forum wiki. Under Bylaw 2.2(g), at least the 
> required quorum number must participate in the ballot for the ballot 
> to be valid, either by voting in favor, voting against, or abstaining.
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20170405/479936ec/attachment-0003.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.jpg
Type: image/jpeg
Size: 9540 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/public/attachments/20170405/479936ec/attachment-0003.jpg>