Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Clarify OUs in CA Certificates #398

Merged
merged 8 commits into from
Nov 3, 2022
Merged

Clarify OUs in CA Certificates #398

Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
d3acef4
Clarify that OUs are not allowed for CA Certificates described in sec…
dzacharo Oct 21, 2022
b68b044
Fix typo with quotes
dzacharo Oct 21, 2022
8c88f98
Update based on F2F 57
dzacharo Oct 26, 2022
bd9d4d3
fix effective date
dzacharo Oct 26, 2022
27d27b0
Fix references and adding the two types of TLS CAs
dzacharo Oct 26, 2022
56036ed
Improve language around OUs in CA Certificates
dzacharo Oct 27, 2022
18e46b4
Capitalize "CA certificates" for consistency
dzacharo Oct 27, 2022
77b874d
Fix typo
dzacharo Nov 3, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/BR.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2691,6 +2691,7 @@ The following table details the acceptable `AttributeType`s that may appear with
| `postalCode` | MAY | If present, the CA's zip or postal information. | [Section 3.2.2.1](#3221-identity) |
| `streetAddress` | MAY | If present, the CA's street address. Multiple instances MAY be present. | [Section 3.2.2.1](#3221-identity) |
| `organizationName` | MUST | The CA's name or DBA. The CA MAY include information in this field that differs slightly from the verified name, such as common variations or abbreviations, provided that the CA documents the difference and any abbreviations used are locally accepted abbreviations; e.g. if the official record shows "Company Name Incorporated", the CA MAY use "Company Name Inc." or "Company Name". | [Section 3.2.2.2](#3222-dbatradename) |
| `organizationalUnitName` | _Effective 2022-12-12_ "MUST NOT" for Root CA Certificates defined in [Section 7.1.2.1](#7121-root-ca-certificate-profile) or TLS Subordinate CA Certificates defined in [Section 7.1.2.5](#7125-technically-constrained-tls-subordinate-ca-certificate-profile) or Technically-Constrained TLS Subordinate CA Certificate defined in [Section 7.1.2.6](#7126-tls-subordinate-ca-certificate-profile). "SHOULD NOT" for all other CAs | - | - |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this more clear (no worries, if it's not!)?

| organizationalUnitName | - | - | - |
| \ \ \ \ Effective 2022-12-12 for Root CA Certificates defined in Section 7.1.2.1, TLS Subordinate CA Certificates defined in Section 7.1.2.5, or Technically-Constrained TLS Subordinate CA Certificates defined in Section 7.1.2.6 | MUST NOT | - |
| \ \ \ \ Effective 2022-12-12 for all other CAs | SHOULD NOT | - |

We could also consider adding a third line to cover the "prior" period (i.e., "Prior to 2022-12-12").

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll also add that we probably should change "CAs" to "CA Certificates"

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have a top-level effective date for this ballot of 2023-04-15, so I don't think we need another effective date here.

dzacharo marked this conversation as resolved.
Show resolved Hide resolved
| `commonName` | MUST | The contents SHOULD be an identifier for the certificate such that the certificate's Name is unique across all certificates issued by the issuing certificate. | |
| Any other attribute | NOT RECOMMENDED | - | See [Section 7.1.4.3](#7143-other-subject-attributes) |

Expand Down