{"action":"opened","issue":{"url":"https://api.github.com/repos/mozilla/pkipolicy/issues/77","repository_url":"https://api.github.com/repos/mozilla/pkipolicy","labels_url":"https://api.github.com/repos/mozilla/pkipolicy/issues/77/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/pkipolicy/issues/77/comments","events_url":"https://api.github.com/repos/mozilla/pkipolicy/issues/77/events","html_url":"https://github.com/mozilla/pkipolicy/issues/77","id":224489627,"number":77,"title":"Indicate direction of travel with respect to permitted domain validation methods","user":{"login":"gerv","id":299746,"avatar_url":"https://avatars1.githubusercontent.com/u/299746?v=3","gravatar_id":"","url":"https://api.github.com/users/gerv","html_url":"https://github.com/gerv","followers_url":"https://api.github.com/users/gerv/followers","following_url":"https://api.github.com/users/gerv/following{/other_user}","gists_url":"https://api.github.com/users/gerv/gists{/gist_id}","starred_url":"https://api.github.com/users/gerv/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gerv/subscriptions","organizations_url":"https://api.github.com/users/gerv/orgs","repos_url":"https://api.github.com/users/gerv/repos","events_url":"https://api.github.com/users/gerv/events{/privacy}","received_events_url":"https://api.github.com/users/gerv/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2017-04-26T14:34:39Z","updated_at":"2017-04-26T14:34:39Z","closed_at":null,"body":"The last CA Communication said:\r\n\r\n> The only permitted methods of domain validation are those documented in section 3.2.2.4 of version 1.4.1 (and not any other version) of the CA/Browser Forum's Baseline Requirements (BRs) . Section 3.2.2.4 of version 1.4.1 of the BRs provides 10 different ways in which the CA may confirm that the certificate subscriber owns/controls the domain name to be included in the certificate, and your CP/CPS must clearly specify the procedures that the CA employs. Each documented procedure should state which subsection of 3.2.2.4 it is complying with.\r\n\r\n> Note that version 1.4.2 of the BRs does not contain all 10 of these methods, but it does contain section 3.2.2.4.11, \"Other Methods\", so the methods that were removed in version 1.4.2 of the BRs are still BR-compliant under that version. By Mozilla policy, CAs are not permitted to rely on the \"Other Methods\" section to use methods of domain validation that are not among the 10 listed in section 3.2.2.4 of version 1.4.1 of the BRs. The IPR issues relating to these missing methods have been resolved, so Mozilla expects that they will soon be restored. When they are, Mozilla's policy will once again be that we accept all of the methods of domain validation explicitly listed in the latest version of the BRs. \r\n\r\nMozilla's Root Store Policy does not yet reflect this policy of requiring one of the 10 Blessed Methods, as promulgated in the CA Communication. I was planning to wait until the latest version of the BRs had all 10 methods in, but that ballot (ballot 190) seems to be taking a bit of time to draft. So perhaps it would be good to add language to indicate direction of travel. This would involve replacing section 2.2.3 of the policy with:\r\n\r\n> for a certificate capable of being used for SSL-enabled servers, the CA must ensure that the applicant has registered the domain(s) referenced in the certificate or has been authorized by the domain registrant to act on their behalf. This must be done using one or more of the 10 methods documented in section 3.2.2.4 of version 1.4.1 (and not any other version) of the CA/Browser Forum Baseline Requirements. The CA's CP/CPS must clearly specify the procedure(s) that the CA employs, and each documented procedure should state which subsection of 3.2.2.4 it is complying with. Even if the current version of the BRs contains a method 3.2.2.4.11, CAs are not permitted to use this method.\r\n\r\nOnce the BRs are back to the way they should be, a few edits to this para should normalize the situation."}}
{"actor":{"display_login":"gerv"}}