bad reference to BR in EVG postalCode field requirement

[mr-m0nst3r]

Hi,

I'm searching the requirements for EV certificates that whether postalCode is required or not, here's what EVG saying:

servercert/docs/EVG.md

Lines 1377 to 1386 in b6a014d

	##### 7.1.4.2.6 Subject Physical Address of Place of Business Field
	__Certificate Fields__:
	Number and street: `subject:streetAddress` (OID: 2.5.4.9)
	City or town: `subject:localityName` (OID: 2.5.4.7)
	State or province (where applicable): `subject:stateOrProvinceName` (OID: 2.5.4.8)
	Country: `subject:countryName` (OID: 2.5.4.6)
	Postal code: `subject:postalCode` (OID: 2.5.4.17)
	__Required/Optional__: As stated in Section 7.1.4.2.2 d, e, f, g and h of the Baseline Requirements.
	__Contents__: This field MUST contain the address of the physical location of the Subject's Place of Business.

It's referencing BR Section 7.1.4.2.2 d, e, f, g, and h, which can't be found in BR.

Maybe we should correct this, but I can't find a proper section, any ideas?

[github-actions]

This issue was created based on:

• TLS BR Version 2.1.7
• EVG Version 2.0.1

[dzacharo]

Indeed, 7.1.4.2.2 was the section before the profiles ballot. These references need to be fixed in the EV Guidelines.

[kate-alekseeva]

@dzacharo the current reference in EVG 7.1.4.2.6 points to a BR section that was removed during the Profiles ballot. BR 7.1.2.7.5 also makes it clear that the EV Subject DN is defined entirely by the EV Guidelines.

Given that, instead of trying to update the reference to the BRs, it seems more appropriate to add the correct requirements directly in EVG 7.1.4.2.6 for the address fields (streetAddress, localityName, stateOrProvinceName, postalCode, countryName).

I’m not sure whether aligning EVG Section 7 with the BR-style tabular format for subject attributes has been considered before, but that might be something worth looking at separately for consistency.

For this specific issue, a self-contained text like the example below (or similar) would resolve the broken reference:

7.1.4.2.6 Subject Physical Address of Place of Business Field

Certificate Fields:
Number and street: subject:streetAddress (OID: 2.5.4.9)
Locality (if required): subject:localityName (OID: 2.5.4.7)
State or province (if required): subject:stateOrProvinceName (OID: 2.5.4.8)
Country: subject:countryName (OID: 2.5.4.6)
Postal code: subject:postalCode (OID: 2.5.4.17)

Required/Optional: Required/Optional

Contents:
These fields MUST contain the verified physical address of the Subject’s Place of Business.

The countryName field MUST be present and MUST contain the applicable two-letter ISO 3166-1 country code. If the country is not represented by an official ISO 3166-1 code, the ISO 3166-1 user-assigned code “XX” MUST be used.

The localityName and stateOrProvinceName fields are OPTIONAL, but at least one of them MUST be present. When included, these fields MUST accurately represent the locality and/or state or province information verified in accordance with Section 3.2.2.1 of the Baseline Requirements.

The streetAddress and postalCode fields are OPTIONAL. If present, they MUST contain the verified street address and postal information of the Subject’s Place of Business as required by Section 3.2.2.1 of the Baseline Requirements. Multiple streetAddress attributes MAY be present.

[dzacharo]

I am fine with this approach. Should probably add this in the preface of the clean-up ballot to make sure Members have time to review.