[cabf_validation] Approved minutes for 2022-11-17

[Corey Bonnell]

Attendees


Aaron Poulsen - (Amazon), Aneta Wojtczak-Iwanicka - (Microsoft), Ben Wilson
- (Mozilla), Bruce Morton - (Entrust), Chris Clements - (Google), Corey
Bonnell - (DigiCert), Corey Rasmussen - (OATI), Dimitris Zacharopoulos -
(HARICA), Dustin Hollenback - (Microsoft), Enrico Entschew - (D-TRUST),
Joanna Fox - (TrustCor Systems), Johnny Reading - (GoDaddy), Joseph Ramm -
(OATI), Martijn Katerbarg - (Sectigo), Michael Slaughter - (Amazon),
Michelle Coon - (OATI), Nargis Mannan - (SecureTrust), Paul van
Brouwershaven - (Entrust), Pekka Lahtiharju - (Telia Company), Rebecca
Kelley - (Apple), Ryan Dickson - (Google), Stephen Davidson - (DigiCert),
Tobias Josefowitz - (Opera Software AS), Trevoli Ponds-White - (Amazon),
Tyler Myers - (GoDaddy), Wayne Thayer - (Fastly)


Antitrust statement


The antitrust statement was read.


Minutes


The next two scheduled minute takers were not on the call. Martijn
volunteered to take minutes.


Approval of previous minutes


Minutes of the November 3rd meeting were approved


Certificate profiles discussion


No current open PRs. Corey is working on reflecting the ballots of the last
year into the certificate profiles branch. 


No further discussion at this time


Inclusion of LEI in Subject


GitHub issue 354 has been in our backlog for a while. With the S/MIME BRs
being approved, Inigo ask the question if we want to increase the priority
on this. Dimitris raised the point that if the S/MIME WG has defined
language, we may just need to copy their language, which would make it an
easy ballot. If anyone in this group wants to draft language, they can go
ahead and it may not take much discussion time.


There's consensus on keeping the profile ballot as the highest priority.
Dimitris volunteered to start drafting language and will reach out to Inigo,
but not create a ballot before the profiles ballot has passed.


Trevoli mentioned that last time LEI was discussed there was a lot of
support from CAs it, but pushback from some of the browsers. If there is any
direct concern it is requested they reach out. Ryan stated he will discuss
internally to see if there are any immediate concerns.


Use of "Applicant" and "Applicant Representative"


Continuing in section 9.6 of the BRs

*	9.6.1 (1)(i): The "right to use" seems to be a point to discuss. All
domain validation methods currently use "control of". Ben believes this is
historical language and possibly no longer applicable. Group consensus is to
check through section 3.2.2.4 before possibly removing this part of the
language in the entire section in a future cleanup ballot.
*	9.6.1 (1)(ii): No issues
*	9.6.1 (5) & (5)(i): No issues
*	9.6.1 (6): The section specifically calls out the scenario where the
CA and Subscriber are the same party, or affiliates. There's a discussion on
the fact that a CA needs to agree to its own terms. A backlog issue will be
created to revisit this item in the future. Corey mentions that going
through section 9.6.3. may give more clarity on why the language is added as
such.
*	9.6.3: "The CA SHALL implement a process to ensure that each
Subscriber Agreement or Terms of Use is legally enforceable against the
Applicant" is called out again as an issue when the CA is also the
Subscriber. The fact that the hosting provider is called out in this section
is also raised by Corey, however not discussed due to time constraints.

We will resume discussion of 9.6.3 on the December 1st meeting.

Meeting adjourned.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/validation/attachments/20221215/68da6391/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4990 bytes
Desc: not available
URL: <http://lists.cabforum.org/pipermail/validation/attachments/20221215/68da6391/attachment.p7s>