<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Clarification, I am happy to write the draft proposed but ICANN has to be behind it.<div><br><div><div>On Feb 1, 2013, at 10:25 AM, Phillip wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><base href="x-msg://6/"><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">I think we should push back on ICANN on this. They are changing the Internet infrastructure they are custodians of and getting paid a lot of money regulate that change. They are in the position to collect information that we need.<div><br></div><div>The public suffix list is a hack. It should go away. There needs to be a mechanism for determining if a domain is a public suffix or not but that information should be distributed through the DNS and not through an ad hoc list that a third party is meant to be maintaining under ill-defined criteria and without the active participation of the TLD operators. </div><div><br></div><div>At the moment TLDs are very expensive. But there is no particular reason that a TLD should be any more expensive than a domain in .com or .net. I can't see the current two tier domain registration scheme as being stable long term. They will expand to a few hundred domains, then a few thousand and then the IPR lobby in ICANN will decide that they want domains like .google and .microsoft as the norm and there will be a move to open up the root zone like any other registry and there will be a likelihood of millions of domains appearing overnight. There is no possibility we could keep up in that environment so we have to push back now before a precedent is set.</div><div><br></div><div><br></div><div>The proper way to publish this information is in the DNS itself. ICANN should propose a record type to IETF that is a 'public suffix' extension. All Registries under the authority of ICANN would be directed to publish the new record in all domains that are public suffixes (.com, .net) the country code TLDs that are not under ICANN authority would be advised to publish the record at their public delegation points (.co.uk, .ac.uk).<br><div><br></div><div>The Public Suffix list should only be operated as a short term measure until this important task is taken on by the body that is equipped to do it properly. CABForum is not equipped to manage that type of list and we are not the only party that depends on it. Javascript implementations also depend on the public suffix list as do several others.</div><div><br></div><div>Any actions we take in the short term to react to this change should have a sunset period.</div><div><br></div><div><br></div><div>Another point to bear in mind here is that ICANN is not the owner of the TLD space. It is operating the DNS root zone under contract and that contract could change in the future. So the wording of any requirements should specify DNS root management authority rather than ICANN directly. </div><div><br></div><div><br><div><div>On Jan 31, 2013, at 12:36 AM, Jeremy Rowley wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; "><div lang="EN-US" link="blue" vlink="purple"><div class="WordSection1" style="page: WordSection1; "><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Hi everyone,<o:p></o:p></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><o:p> </o:p></div><p class="line874" style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 12pt; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; "><span style="font-family: Cambria, serif; color: black; ">Because ICANN will begin the process of issuing new generic Top Level Domains (gTLDs) in 2012, certain Certificates for non-public names will need to be revoked on an accelerated schedule in order to prevent collisions and possible MITM attacks on newly registered domains. ICANN is primary concerned about the number of *.gTLD certificates that CAs have previously issued. For example, *.XXX may exist despite being .XXX being approved for registration back in 2010.<o:p></o:p></span></p><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: Cambria, serif; ">The attached motion is intended to eliminate erratic use of wildcard characters and mitigate the ICANN security concerns while providing a transition period for affected customers. I’m looking for an additional endorser.<o:p></o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: Cambria, serif; "><o:p> </o:p></span></div><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; "><span style="font-size: 12pt; font-family: Cambria, serif; ">----------------<o:p></o:p></span></div><h3 style="margin-top: 12pt; margin-right: 0in; margin-bottom: 12pt; margin-left: 0in; text-align: justify; page-break-after: avoid; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-family: Cambria, serif; font-weight: normal; "><o:p> </o:p></span></h3><h3 style="margin-top: 12pt; margin-right: 0in; margin-bottom: 12pt; margin-left: 0in; text-align: justify; page-break-after: avoid; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-family: Cambria, serif; font-weight: normal; ">Jeremy Rowley made the following motion, and Rick Andrews and ______________ endorsed it:<o:p></o:p></span></h3><h3 style="margin-top: 12pt; margin-right: 0in; margin-bottom: 12pt; margin-left: 0in; text-align: justify; page-break-after: avoid; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-family: Cambria, serif; font-weight: normal; ">---- Motion Begins ----<o:p></o:p></span></h3><h3 style="margin-top: 12pt; margin-right: 0in; margin-bottom: 12pt; margin-left: 0in; text-align: justify; page-break-after: avoid; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-family: Cambria, serif; font-weight: normal; ">---- Erratum Begins ----<o:p></o:p></span></h3><h3 style="margin-top: 12pt; margin-right: 0in; margin-bottom: 12pt; margin-left: 0in; text-align: justify; page-break-after: avoid; font-size: 12pt; font-family: 'Times New Roman', serif; "><a name="_Toc310247246"></a><a name="_Ref273699070"></a><a name="_Ref281487439"></a><span style="font-family: Cambria, serif; font-weight: normal; ">Add the following as new Section 11.1.3:</span><span style="font-family: Cambria, serif; font-weight: normal; "><o:p></o:p></span></h3><h3 style="margin-top: 12pt; margin-right: 0in; margin-bottom: 12pt; margin-left: 0in; text-align: justify; page-break-after: avoid; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-family: Cambria, serif; ">11.1 Authorization by Domain Name Registrant<o:p></o:p></span></h3><h3 style="margin-top: 12pt; margin-right: 0in; margin-bottom: 12pt; margin-left: 0in; text-align: justify; page-break-after: avoid; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-family: Cambria, serif; ">11.1.3 Wildcard Domain Validation<o:p></o:p></span></h3><p class="line874" style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 12pt; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; "><span style="font-family: Cambria, serif; color: black; ">Before issuing a certificate with a wildcard character (*) in a CN or subjectAltName of type DNS-ID, the CA MUST establish and follow a documented procedure† that determines if the wildcard character occurs in the first label position to the left of a “registry-controlled” label or “public suffix” (e.g. “*.com”, “*.co.uk”, see RFC 6454 Section 8.2 for further explanation).<o:p></o:p></span></p><p class="line874" style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 12pt; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; "><span style="font-family: Cambria, serif; color: black; ">If a wildcard would fall within the label immediately to the left of a registry-controlled† or public suffix, CAs MUST refuse issuance unless the applicant proves its rightful control of the entire Domain Namespace. (e.g. CAs MUST NOT issue “*.co.uk” or “*.local”, but MAY issue “*.example.com” to Example Co.). <o:p></o:p></span></p><p class="line874" style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 12pt; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; "><span style="font-family: Cambria, serif; color: black; ">Prior to September 1, 2013, each CA MUST revoke any valid certificate that does not comply with this section of the Requirements.<o:p></o:p></span></p><p class="line862" style="margin-right: 0in; margin-left: 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 12pt; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; "><span style="font-family: Cambria, serif; color: black; ">†Determination of what is “registry-controlled” versus the registerable portion of a<span class="Apple-converted-space"> </span></span><span style="font-family: Cambria, serif; ">Country Code Top-Level Domain Namespace<span class="Apple-converted-space"> </span><span style="color: black; ">is not standardized at the time of writing and is not a property of the DNS itself. Current best practice is to consult a “public suffix list” such as<span class="apple-converted-space"> </span></span></span><a href="http://publicsuffix.org/" style="color: blue; text-decoration: underline; "><span style="font-family: Cambria, serif; border-top-style: none; border-right-style: none; border-bottom-style: none; border-left-style: none; border-top-color: windowtext; border-right-color: windowtext; border-bottom-color: windowtext; border-left-color: windowtext; border-top-width: 1pt; border-right-width: 1pt; border-bottom-width: 1pt; border-left-width: 1pt; padding-top: 0in; padding-right: 0in; padding-bottom: 0in; padding-left: 0in; ">http://publicsuffix.org/</span></a><span style="font-family: Cambria, serif; color: black; ">. If the process for making this determination is standardized by an RFC, then such a procedure SHOULD be preferred.</span><span style="font-family: Cambria, serif; "><o:p></o:p></span></p><h3 style="margin-top: 12pt; margin-right: 0in; margin-bottom: 12pt; margin-left: 0in; text-align: justify; page-break-after: avoid; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-family: Cambria, serif; font-weight: normal; ">Add the following as new Section 11.1.4:<o:p></o:p></span></h3><h3 style="margin-top: 12pt; margin-right: 0in; margin-bottom: 12pt; margin-left: 0in; text-align: justify; page-break-after: avoid; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-family: Cambria, serif; ">11.1.4 New gTLD Domains<o:p></o:p></span></h3><p class="line874" style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 12pt; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; "><span style="font-family: Cambria, serif; color: black; ">Prior to issuing a Certificate containing an Internal Server Name with a gTLD that ICANN has announced as under consideration to make operational, the CA MUST provide a warning to the applicant that the gTLD may soon become resolvable and that, at that time, the CA will revoke the Certificate unless the applicant promptly registers the domain name. CAs SHOULD NOT issue Certificates containing a new gTLD under consideration by ICANN.<o:p></o:p></span></p><p class="line874" style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 12pt; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; "><span style="font-family: Cambria, serif; color: black; ">Within 30 days after a CA is made aware that ICANN approved a<span class="Apple-converted-space"> </span></span><span style="font-family: Cambria, serif; ">new gTLD for operation:<o:p></o:p></span></p><p class="line874" style="margin-right: 0in; margin-left: 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 12pt; text-indent: -0.25in; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; "><span style="font-family: Cambria, serif; "><span>1)<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span style="font-family: Cambria, serif; ">Each CA MUST compare the new gTLD against the CA’s records of valid certificates.<o:p></o:p></span></p><p class="line874" style="margin-right: 0in; margin-left: 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 12pt; text-indent: -0.25in; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; "><span style="font-family: Cambria, serif; color: black; "><span>2)<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span style="font-family: Cambria, serif; ">If a valid certificate contains a FQDN whose public suffix is the same as the<span class="Apple-converted-space"> </span><span style="color: black; ">new gTLD, the CA MUST re-verify that the Subscriber is either the Domain Name Registrant or has control over the FQDN in accordance with Section 11.1. <o:p></o:p></span></span></p><p class="line874" style="margin-right: 0in; margin-left: 0.5in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 12pt; text-indent: -0.25in; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; "><span style="font-family: Cambria, serif; color: black; "><span>3)<span style="font: normal normal normal 7pt/normal 'Times New Roman'; "> <span class="Apple-converted-space"> </span></span></span></span><span style="font-family: Cambria, serif; color: black; ">The CA MUST revoke a Certificate containing a Domain Name that includes the new gTLD if the Subscriber is not the Domain Name Registrant and the Subscriber cannot demonstrate control over the domain within 60 days after the new gTLD becomes publicly resolvable in the DNS.<o:p></o:p></span></p><h3 style="margin-top: 12pt; margin-right: 0in; margin-bottom: 12pt; margin-left: 0in; text-align: justify; page-break-after: avoid; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-family: Cambria, serif; font-weight: normal; ">---- Motion Ends ----<o:p></o:p></span></h3><h3 style="margin-top: 12pt; margin-right: 0in; margin-bottom: 12pt; margin-left: 0in; text-align: justify; page-break-after: avoid; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-family: Cambria, serif; font-weight: normal; ">---- Erratum Ends ----<o:p></o:p></span></h3><p class="line874" style="margin-right: 0in; margin-left: 0in; font-size: 12pt; font-family: 'Times New Roman', serif; margin-bottom: 12pt; background-image: initial; background-attachment: initial; background-origin: initial; background-clip: initial; background-color: white; background-position: initial initial; background-repeat: initial initial; "><span style="font-family: Cambria, serif; ">Thanks,<o:p></o:p></span></p><div style="margin-top: 0in; margin-right: 0in; margin-left: 0in; margin-bottom: 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; ">Jeremy<o:p></o:p></div></div>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org" style="color: blue; text-decoration: underline; ">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" style="color: blue; text-decoration: underline; ">https://cabforum.org/mailman/listinfo/public</a></div></span></blockquote></div><br></div></div></div>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>https://cabforum.org/mailman/listinfo/public<br></blockquote></div><br></div></body></html>