Re: [Servercert-wg] [External Sender] Question regarding the id-ad-caIssuers accessMethod URI

Hi Clint, > My understanding is that the intent was indeed to restrict these to HTTP > specifically. That matches my understanding as well. > I’m not convinced a clarification is worthwhile here. To be clear, I’m not > opposed, I’m just not sure it’s something CAs are actively getting

Re: [Servercert-wg] IDNA2003 vs IDNA2008 usage

Hi Martijn, The same Punycode algorithm as defined in RFC 3492 is used by IDNA2003, 2008, and more to convey Unicode code points in domain labels in a way that conforms to the LDH syntax. The BRs currently require that any labels that are prefixed with “xn—” contain valid Punycode-encoded

Re: [Servercert-wg] Ballot to introduce linting in the TLS BRs

Hi Dimitris, I’d be happy to endorse and help flesh out the language. Thanks, Corey From: Servercert-wg On Behalf Of Dimitris Zacharopoulos (HARICA) via Servercert-wg Sent: Sunday, March 17, 2024 8:20 AM To: CA/B Forum Server Certificate WG Public Discussion List Subject:

Re: [Servercert-wg] [Voting Period Begins]: SC65: Convert EVGs into RFC 3647 format v2

DigiCert votes YES on SC-65v2. While the ballot motion contains a potentially confusing redline link, it does not affect the actual text changes introduced by the ballot. Additionally, the reformat proposed by this ballot is valuable in getting us closer to consistently formatted documents, so

Re: [Servercert-wg] [Voting Period Begins]: SC-69v3 Clarify router and firewall logging requirements

DigiCert votes YES to SC-69v3. Thanks, Corey From: Servercert-wg On Behalf Of Martijn Katerbarg via Servercert-wg Sent: Monday, March 4, 2024 5:59 AM To: CA/B Forum Server Certificate WG Public Discussion List Subject: [Servercert-wg] [Voting Period Begins]: SC-69v3 Clarify router and

Re: [Servercert-wg] [Discussion Period Begins]: SC65: Convert EVGs into RFC 3647 format

Hi Inigo, It appears the hyperlink I provided doesn’t immediately highlight the line (you have to go digging for it). Perhaps explaining it would be easier: EVG version 1.8.0, section 9.8.2 says: “where the subfields have the same values, meanings, and restrictions described in Section

Re: [Servercert-wg] [Discussion Period Begins]: SC65: Convert EVGs into RFC 3647 format

Also, apologies for sending this feedback late. I had intended to review and send earlier this week, but I got bogged down with a few other urgent matters and didn’t have a chance to review until this AM. From: Servercert-wg On Behalf Of Corey Bonnell via Servercert-wg Sent: Friday, February

Re: [Servercert-wg] [Discussion Period Begins]: SC65: Convert EVGs into RFC 3647 format

Hi Inigo, I did a cursory review of the draft ballot and have a few comments: 1. Line 1303 indicates that the values of the CABFOrganizationIdentifier extension MUST be derived from the OrganizationName attribute as opposed to the OrganizationIdentifier attribute:

Re: [Servercert-wg] Allow VATEL for organizationIdentifier values in EV Guidelines

Hi Dimitris, I’d be happy to endorse. Thanks, Corey From: Servercert-wg On Behalf Of Dimitris Zacharopoulos (HARICA) via Servercert-wg Sent: Monday, January 8, 2024 12:39 PM To: CA/B Forum Server Certificate WG Public Discussion List Subject: [Servercert-wg] Allow VATEL for

Re: [Servercert-wg] Voting period begins: Ballot SC-066: Fall 2023 Clean-up v2

Hi Inigo, Comments inline. > the chair of the CWG can perform some changes that do not change anything > without requiring a ballot procedure, so I guess there´s nothing to > vote/discuss there Perhaps I’m misunderstanding what you’re saying, but changing the formatting/content will

Re: [Servercert-wg] Ballot SC-066: Fall 2023 Clean-up (voting period)

I believe this URL does the trick: https://github.com/cabforum/servercert/compare/90a98dc7c1131eaab01af411968aa7330d315b9b...b72da7a87955aed81d14f9fe96ee222098fd4264. As Dimitris mentioned, it’s important that the redline URL uses the specific commit hashes to ensure the ballot cannot be

[Servercert-wg] DigiCert’s OSS pkilint adds support for CABF Ballot SC-62

DigiCert releases significant update for its open source linting framework, pkilint, to support linting certificates against the Ballot SC-62 profiles Building on the successful release earlier this year of pkilint as open-source software under the permissive MIT license, DigiCert is pleased to

Re: [Servercert-wg] Draft ballot SC-XX: Profiles cleanup ballot

t issues MUST comply with one of the following certificate profiles, which incorporate, and are derived from RFC 5280.” Thanks, Wendy Wendy Brown Supporting GSA FPKIMA Technical Liaison Protiviti Government Services 703-965-2990 (cell) On Wed, Jul 19, 2023 at 10:16 AM Corey Bonnell via Ser

Re: [Servercert-wg] Draft ballot SC-XX: Profiles cleanup ballot

, and are derived from RFC 5280.” Thanks, Wendy Wendy Brown Supporting GSA FPKIMA Technical Liaison Protiviti Government Services 703-965-2990 (cell) On Wed, Jul 19, 2023 at 10:16 AM Corey Bonnell via Servercert-wg mailto:servercert-wg@cabforum.org> > wrote: Hello, While adding s

Re: [Servercert-wg] Draft ballot SC-XX: Profiles cleanup ballot

it be possible to add to this “profiles cleanup ballot” what was discussed the other day in the infra SC about the “-“ to format correctly the tables generated in section 7? De: Servercert-wg < <mailto:servercert-wg-boun...@cabforum.org> servercert-wg-boun...@cabforum.org> En nombre de Corey Bo

Re: [Servercert-wg] Draft ballot SC-XX: Profiles cleanup ballot

to this “profiles cleanup ballot” what was discussed the other day in the infra SC about the “-“ to format correctly the tables generated in section 7? De: Servercert-wg < <mailto:servercert-wg-boun...@cabforum.org> servercert-wg-boun...@cabforum.org> En nombre de Corey Bonnell vi

[Servercert-wg] Draft ballot SC-XX: Profiles cleanup ballot

Hello, While adding support for SC-62 linting for TLS certificates in pkilint, a few issues were identified with the current language in section 6 and 7 of the BRs. To address these issues, I created a draft ballot on Github. The draft ballot text can be viewed here: