EVG

# Appendix B - Sample Attorney Opinions Confirming Specified Information **(Informative)** [Law Firm Letterhead] [Date] | To: | **(Name of Issuing Certification Authority)(Address / fax number of Issuing CA – may be sent by fax or email attachment)** | | --- | --- | | Re: | **EV Certificate Request No. (CA Reference Number)** | | Client: | **(Exact company name of Client – see footnote 1)** | | Client Representative: | **(Exact name of Client Representative who signed the Application – see footnote 2)** | | Application Date: | **(Insert date of Client's Application to the Issuing CA)** | This firm represents _[__exact__ company name of Client]_ [^1] ("Client"), who has submitted the Application to you dated as of the Application Date shown above ("Application"). We have been asked by our Client to present you with our opinion as stated in this letter. [Insert customary preliminary matters for opinion letters in your jurisdiction.] On this basis, we hereby offer the following opinion: 1. That [exact company name of Client] ("Company") is a duly formed [corporation, LLC, etc.] that is "active," "valid," "current," or the equivalent under the laws of the state/province of [name of governing jurisdiction where Client is incorporated or registered] and is not under any legal disability known to the author of this letter. 2. That Company conducts business under the assumed name or "DBA"_[assumed name of the Applicant]_ and has registered such name with the appropriate government agency in the jurisdiction of its place of business below. 3. That _[name of Client's Representative]_[^2] has authority to act on behalf of Company to: [_select as appropriate_] (a) provide the information about Company required for issuance of the EV Certificates as contained in the attached Application, (b) request one or more EV Certificates and to designate other persons to request EV Certificates, and (c) agree to the relevant contractual obligations contained in the Subscriber Agreement on behalf of Company. 4. That Company has a physical presence and its place of business is at the following location: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ 5. That Company can be contacted at its stated place of business at the following telephone number: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ 6. That Company has an active current Demand Deposit Account with a regulated financial institution. 7. That Company has the right to use the following Domain Name in identifying itself on the Internet: \_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_\_ Insert customary limitations and disclaimers for opinion letters in your jurisdiction. (Name and signature) _[Jurisdiction(s) in which attorney / Latin notary is admitted to practice]_[^3] cc: [Send copy to Client_]_ [^1]: This must be the Client's exact corporate name, as registered with the relevant Incorporating Agency in the Client's Jurisdiction of Incorporation. This is the name that will be included in the EV Certificate. [^2]: If necessary to establish the Client Representative's actual authority, you may rely on a Power of Attorney from an officer of Client who has authority to delegate the authority to the Client Representative. [^3]: This letter may be issued by in-house counsel for the Client so long as permitted by the rules of your jurisdiction.

SMIME

TLS

# APPENDIX B – Issuance of Certificates for Onion Domain Names This appendix defines permissible verification procedures for including one or more Onion Domain Names in a Certificate. 1. The Domain Name MUST contain at least two Domain Labels, where the rightmost Domain Label is "onion", and the Domain Label immediately preceding the rightmost "onion" Domain Label is a valid Version 3 Onion Address, as defined in Section 6 of the Tor Rendezvous Specification - Version 3 located at . 2. The CA MUST verify the Applicant’s control over the Onion Domain Name using at least one of the methods listed below: a. The CA MAY verify the Applicant's control over the .onion service by using one of the following methods from [Section 3.2.2.4](#3224-validation-of-domain-authorization-or-control): i. [Section 3.2.2.4.18 - Agreed-Upon Change to Website v2](#322418-agreed-upon-change-to-website-v2) ii. [Section 3.2.2.4.19 - Agreed-Upon Change to Website - ACME](#322419-agreed-upon-change-to-website---acme) iii. [Section 3.2.2.4.20 - TLS Using ALPN](#322420-tls-using-alpn) When these methods are used to verify the Applicant's control over the .onion service, the CA MUST use Tor protocol to establish a connection to the .onion hidden service. The CA MUST NOT delegate or rely on a third-party to establish the connection, such as by using Tor2Web. **Note**: This section does not override or supersede any provisions specified within the respective methods. The CA MUST only use a method if it is still permitted within that section and MUST NOT issue Wildcard Certificates or use it as an Authorization Domain Name, except as specified by that method. b. The CA MAY verify the Applicant's control over the .onion service by having the Applicant provide a Certificate Request signed using the .onion service's private key if the Attributes section of the certificationRequestInfo contains: i. A caSigningNonce attribute that contains a Random Value that is generated by the CA; and ii. An applicantSigningNonce attribute that contains a single value. The CA MUST recommend to Applicants that the applicantSigningNonce value should contain at least 64 bits of entropy. The signing nonce attributes have the following format: ```ASN.1 cabf OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) international-organizations(23) ca-browser-forum(140) } caSigningNonce ATTRIBUTE ::= { WITH SYNTAX OCTET STRING EQUALITY MATCHING RULE octetStringMatch SINGLE VALUE TRUE ID { cabf-caSigningNonce } } cabf-caSigningNonce OBJECT IDENTIFIER ::= { cabf 41 } applicantSigningNonce ATTRIBUTE ::= { WITH SYNTAX OCTET STRING EQUALITY MATCHING RULE octetStringMatch SINGLE VALUE TRUE ID { cabf-applicantSigningNonce } } cabf-applicantSigningNonce OBJECT IDENTIFIER ::= { cabf 42 } ``` The Random Value SHALL remain valid for use in a confirming response for no more than 30 days from its creation. The CPS MAY specify a shorter validity period for Random Values. Once the FQDN has been validated using this method, the CA MAY also issue Certificates for other FQDNs that end with all the labels of the validated FQDN. This method is suitable for validating Wildcard Domain Names. 3. When a Certificate includes an Onion Domain Name, the Domain Name shall not be considered an Internal Name provided that the Certificate was issued in compliance with this [Appendix B](#appendix-b--issuance-of-certificates-for-onion-domain-names).