[Acme] Fwd: EV ACME

Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com> Wed, 09 October 2019 14:48 UTC

MIME-Version: 1.0
References: <BN6PR14MB1106A3919B49805F5D05A37E83580@BN6PR14MB1106.namprd14.prod.outlook.com> <CAHbuEH55K11QFw55bP974gDn3_gLtNB7LZZEdPL7Xv+z47JpqQ@mail.gmail.com> <BN6PR14MB110602210252888C1E97DB2883580@BN6PR14MB1106.namprd14.prod.outlook.com> <CAHbuEH4rPFRwDU7h6q-SM+YeFzqnsPq5sfFDNgmWj3jZD_WTqA@mail.gmail.com> <CAHbuEH5PqMN7upFxH7z0m3oAGy5CvQkJB1oMDQaPKe2DyL+ZnQ@mail.gmail.com> <CAHbuEH6rzr3MSCsHs883fkYTjDpLdwdfJ=4sqcbJNer4eDJfcQ@mail.gmail.com> <MWHPR14MB1456F15D5936D20CEED824C883850@MWHPR14MB1456.namprd14.prod.outlook.com>
In-Reply-To: <MWHPR14MB1456F15D5936D20CEED824C883850@MWHPR14MB1456.namprd14.prod.outlook.com>
From: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
Date: Wed, 09 Oct 2019 10:47:21 -0400
Message-ID: <CAHbuEH7ChwEscPBqLygVVMGEgM1DTmm4Ah+c93mbDaUNq=8-9Q@mail.gmail.com>
To: IETF ACME <acme@ietf.org>
Content-Type: multipart/alternative; boundary="000000000000ecad3705947b5e8c"
Archived-At: <https://mailarchive.ietf.org/arch/msg/acme/aZR-Xm7Gci24RmM21GiQkqdQDMw>
Subject: [Acme] Fwd: EV ACME
Precedence: list

Sharing comments to the list per Tim saying that would be okay.

---------- Forwarded message ---------
From: Tim Hollebeek <tim.hollebeek@digicert.com>
Date: Mon, Sep 23, 2019 at 3:56 PM
Subject: RE: EV ACME
To: Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>

   1. Introduction

“Code SIgning” -> “Code Signing”

I don’t usually think of code signing being a subset of client
certificates.  I usually limit it to the Client Authentication EKU.

   1. Top of page four: stray ? at end of line
   2. Part 5:

EV code signing certificates have a distinct set of requirements from EV
web certificates.  In particular, they don’t have associated domain names,
nor is CAA checking done.  It’s not entirely clear how it could be done, as
the certificate links a public key to an organization, not a domain.

   1. Lifetimes are less of an issue for code-signing certificates, but
   there is a legitimate use case for “one signature per certificate”, which
   also requires fast and easy issuance.  Having only one signature per
   certificate makes it possible to revoke individual signatures.  This should
   probably be discussed somewhere.

*From:* Kathleen Moriarty <kathleen.moriarty.ietf@gmail.com>
*Sent:* Friday, September 20, 2019 11:10 AM
*To:* Tim Hollebeek <tim.hollebeek@digicert.com>
*Subject:* Re: EV ACME

Hi Tim,

Are you interested to help still with the ACME client draft?  Would you
like to send additions changes or work from the file?

Thank you,

Kathleen

[Acme] Fwd: EV ACME Kathleen Moriarty