Ballot 208 – dnQualifiers

Ballot overview

• Ballot 208, dnQualifiers, proposed changes to the Baseline Requirements to allow CAs to use dnQualifiers in certificates to partition groups of certificates into different sets and to allow non-identity information in DV certificates.
• The motion would replace the definition of Subject Identity Information and add a new subject:dnQualifier field in Section 7.1.4.2.2 Subject Distinguished Name Fields.

Proposed technical changes

• Subject Identity Information would no longer include dnQualifier attributes in Distinguished Names, commonName attributes in Distinguished Names, dNSName Subject Alternative Names, iPAddress Subject Alternative Names, or SRVName Subject Alternative Names.
• The new subject:dnQualifier field would be optional and intended for use when several certificates with the same subject can be partitioned into sets of related certificates.
• Related certificate sets may share the same dnQualifier.
• A CA may include a zero-length dnQualifier value to indicate no assertion about relationship with other certificates with the same subject.
• A CA may set the dnQualifier value to the base64 encoding of the SHA1 hash of the subjectAlternativeName extnValue to indicate grouping by alternative name set.

Ballot process and timing

• Discussion begins October 12, 2017 22:00 UTC and ends October 19, 2017 22:00 UTC.
• Vote for approval begins October 19, 2017 22:00 UTC and ends October 26, 2017 22:00 UTC.
• If the vote approves the ballot, there is a 30-day review period after the Chair sends the Review Notice.
• If no Exclusion Notices are filed, the ballot becomes effective at the end of the Review Period.
• If Exclusion Notice(s) are filed, ballot approval is rescinded and a PAG is created.

Result

• The voting period ended and the ballot failed.
• CA voting met the approval threshold, but browser voting did not: 50% of voting browsers voted in favor, and the ballot fails.
• Quorum was met.