[cabf_validation] Registration and Incorporating Agencies Disclosure Formatting

[Joanna Fox]

Hi Ryan,

The detailed response is truly appreciated.  I will pass on the information to the appropriate teams.

Thank you,
Joanna

From: Ryan Sleevi <sleevi at google.com>
Sent: Thursday, September 17, 2020 4:28 PM
To: Joanna Fox <jweber at godaddy.com>; CA/Browser Forum Validation SC List <validation at cabforum.org>
Cc: Corey Bonnell <CBonnell at securetrust.com>
Subject: Re: [cabf_validation] Registration and Incorporating Agencies Disclosure Formatting

Notice: This email is from an external sender.


I thought this specific example was governed by Decree 622 of April 5, 2000<http://ccamazonas.org.co/documentos/decreto622.pdf>, and as Corey mentioned, established the jurisdiction level as "all the municipalities of the department of Amazonas", which would appear to be at the State or Province level.

However, I think you raise a good point, since you have a similar issue with, say, the Aguachia Chambers of Commerce or the Barranquilla Chambers of Commerce.

SC30 was designed to be flexible, and tried to avoid as much as possible any normative requirements on format for the disclosure. So you could do, as you mention, a comma-separated list, or you could do one row for each unique tuple of (locality, stateOrProvince, country). While my own personal preference is to the latter (one row each), that's because I'm primarily optimizing for "How quickly can I match/validate a given certificate to its possible information sources". For CAs, I'm entirely sympathetic that their optimization is probably "How quickly can I maintain and ensure data is correct" (e.g. should ccamazonas.org.co<http://ccamazonas.org.co> change their domain name, or should a supplemental act, such as Decree 4846 of 2017<http://www.suin-juriscol.gov.co/viewDocument.asp?id=1552762>, modify things further)

So, ultimately, I'm team "choose what works best for you to enable disclosure", since that's the primary goal. Aligning formats or other such is intentionally left off, for when we circle back in 3-6 months to discuss next steps, based on the experiences in maintaining the data and the disclosures of the data itself.

On Thu, Sep 17, 2020 at 6:26 PM Joanna Fox via Validation <validation at cabforum.org<mailto:validation at cabforum.org>> wrote:
Hi Corey,

Thanks for the quick response.  What I’m attempting to communicate is questioning when there is one incorporation/registration agency that contains data from multiple localities.  We have found a few examples of this throughout the years in various countries and I want to ensure we are communicating our findings appropriately in our disclosure.

Thanks,
Joanna

From: Corey Bonnell <CBonnell at securetrust.com<mailto:CBonnell at securetrust.com>>
Sent: Thursday, September 17, 2020 1:55 PM
To: Joanna Fox <jweber at godaddy.com<mailto:jweber at godaddy.com>>; CA/Browser Forum Validation SC List <validation at cabforum.org<mailto:validation at cabforum.org>>
Subject: RE: [cabf_validation] Registration and Incorporating Agencies Disclosure Formatting

Hi Joanna,
From SC30:

>  The accepted value or values for each of the `subject:jurisdictionLocalityName` (OID: 1.3.6.1.4.1.311.60.2.1.1), `subject:jurisdictionStateOrProvinceName` (OID: 1.3.6.1.4.1.311.60.2.1.2), and `subject:jursidictionCountryName` (OID: 1.3.6.1.4.1.311.60.2.1.3) fields


Since it appears that source is for incorporation/registration at the state level, there would be nothing listed under locality in your table since the jurisL field in EV certificates should not be populated.

Thanks,
Corey

From: Validation <validation-bounces at cabforum.org<mailto:validation-bounces at cabforum.org>> On Behalf Of Joanna Fox via Validation
Sent: Thursday, September 17, 2020 4:30 PM
To: CA/Browser Forum Validation WG List <validation at cabforum.org<mailto:validation at cabforum.org>>
Subject: [cabf_validation] Registration and Incorporating Agencies Disclosure Formatting

Hello all,

As we are close to completion for this project, I want to ensure that the intent of our Jurisdiction disclosure is understood. In the case where a specific source has multiple possible Jurisdiction options at the locality level, there are a few options for displaying the information. One option is placing those values in one field, comma separated, as displayed below.  Another option is to separate line by line for each differing locality.  This alternate option makes for a substantially longer list but more clearly communicates C/S/L.  Any thoughts or comments are appreciate.

Country
Name of source
Website
Jurisdiction (Country)
Jurisdiction (State or Province)
Jurisdiction (Locality)
Colombia
Cámara de Comercio del Amazonas
http://www.ccamazonas.org.co/actual/<http://scanmail.trustwave.com/?c=4062&d=yMfj31PDDJe1LZyd7Nkh66ceHu4wO906B7v8-KVj4g&s=5&u=http%3a%2f%2fwww%2eccamazonas%2eorg%2eco%2factual%2f>
CO
Amazonas
El Encanto, La Chorrera, La Pedrera, La Victoria, Leticia, Mirití-Paraná, Puerto Alegría, Puerto Arica, Puerto Nariño, Puerto Santander, Tarapacá


Thank you,


Joanna Fox
GoDaddy | Sr. Manager Compliance
[https://email-sig.gd-resources.net/img/godaddy-logo-outline.png]
+1.602.817.7258<tel:(602)%20817-7258> (-7 GMT)
jfox at godaddy.com<mailto:jfox at godaddy.com>

_______________________________________________
Validation mailing list
Validation at cabforum.org<mailto:Validation at cabforum.org>
https://lists.cabforum.org/mailman/listinfo/validation
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/validation/attachments/20200918/97d2be3d/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.png
Type: image/png
Size: 6498 bytes
Desc: image001.png
URL: <http://lists.cabforum.org/pipermail/validation/attachments/20200918/97d2be3d/attachment-0001.png>