<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"><base href="x-msg://3/"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; "><div>Actually this is best practice.</div><div><br></div><div>The underscore character is used as a means of extending the DNS name system. The DNS SRV (service) record started this practice. <a href="http://http.example.com">http.example.com</a> could be a legitimate domain name. So to unambiguously specify the http service of <a href="http://example.com">example.com</a> they used _http instead, actually _http._tcp.</div><div><br></div><div><br></div><div>These names are fully routable. The only thing that is advised against is delegating an underscore name or putting an A record there.</div><div><br></div><br><div><div>On Aug 12, 2013, at 2:22 PM, "Robin Alden" <<a href="mailto:robin@comodo.com">robin@comodo.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite"><div bgcolor="white" lang="EN-GB" link="blue" vlink="purple" style="font-family: Helvetica; font-size: medium; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; "><div class="WordSection1" style="page: WordSection1; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Hi Wayne,<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> I don’t think there’s a need for us (CAs) to ban the use of underscores in dnsNames in certificates.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Comodo has issued certificates including RFC2782 format names, e.g.:<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">_sip._<a href="http://tls.xxxxxxx.com" style="color: purple; text-decoration: underline; ">tls.xxxxxxx.com</a><o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">We have also issued certificates including dnsNames which are probably not (intended to be) internet routable, such as:<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">m_staging9.<a href="http://xxxxxxx.com" style="color: purple; text-decoration: underline; ">xxxxxxx.com</a><o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">In both cases the certificates can be validated using the usual automated DCV process for<span class="Apple-converted-space"> </span><a href="http://xxxxxxx.com" style="color: purple; text-decoration: underline; ">xxxxxxx.com</a><o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">I have to say the numbers of such certificates we see is vanishingly small.<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Regards<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Robin<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="border-style: none none none solid; border-left-width: 1.5pt; border-left-color: blue; padding: 0cm 0cm 0cm 4pt; "><div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(181, 196, 223); padding: 3pt 0cm 0cm; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; color: windowtext; ">From:</span></b><span lang="EN-US" style="font-size: 10pt; font-family: Tahoma, sans-serif; color: windowtext; "><span class="Apple-converted-space"> </span><a href="mailto:public-bounces@cabforum.org" style="color: purple; text-decoration: underline; ">public-bounces@cabforum.org</a><span class="Apple-converted-space"> </span>[mailto:public-<a href="mailto:bounces@cabforum.org" style="color: purple; text-decoration: underline; ">bounces@cabforum.org</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Wayne Thayer<br><b>Sent:</b><span class="Apple-converted-space"> </span>07 August 2013 17:45<br><b>To:</b><span class="Apple-converted-space"> </span>Erwann Abalea;<span class="Apple-converted-space"> </span><a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline; ">public@cabforum.org</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [cabfpub] Underscore Characters in SANs<o:p></o:p></span></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><o:p> </o:p></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Erwann,<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">I’m specifically talking about a CNAME record. In researching this, it appears that DKIM specifies underscore characters in CNAMEs, but it may refer to an updated RFC rather than 1035 in doing so. The DKIM spec has in turn driven major DNS providers to start allowing the underscore character in CNAMEs. I have a few examples of this. So I’m wondering if there’s any reason in practice not to issue certificates with SANs containing this character, other than the fact that it’s probably not compatible with some browsers that expect a proper host name?<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Thanks,<o:p></o:p></span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); "> </span></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125); ">Wayne<o:p></o:p></span></div><div><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0cm 0cm; "><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext; ">From:</span></b><span lang="EN-US" style="font-size: 11pt; font-family: Calibri, sans-serif; color: windowtext; "><span class="Apple-converted-space"> </span><a href="mailto:public-bounces@cabforum.org" style="color: purple; text-decoration: underline; ">public-bounces@cabforum.org</a><span class="Apple-converted-space"> </span>[<a href="mailto:public-bounces@cabforum.org" style="color: purple; text-decoration: underline; ">mailto:public-bounces@cabforum.org</a>]<span class="Apple-converted-space"> </span><b>On Behalf Of<span class="Apple-converted-space"> </span></b>Erwann Abalea<br><b>Sent:</b><span class="Apple-converted-space"> </span>Wednesday, August 07, 2013 2:22 AM<br><b>To:</b><span class="Apple-converted-space"> </span><a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline; ">public@cabforum.org</a><br><b>Subject:</b><span class="Apple-converted-space"> </span>Re: [cabfpub] Underscore Characters in SANs<o:p></o:p></span></div></div></div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US"> </span></div><div><p class="MsoNormal" style="margin: 0cm 0cm 12pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US">Taken from X.509: "dNSName is an Internet domain name defined in accordance with Internet RFC 1035."<br><br>So far, IIRC, the only possible DNS entries that support the underscore character are of type TXT and SRV. A, AAAA, CNAME, NS, MX records can't use such a character.<br>Refering to a TXT entry is useless in a SAN, refering to a SRV entry may have a meaning (this needs to be discussed). But in that case, the entry MUST follow RFC2782 format ("_Service._Proto.Name", for example "_xmpp._<a href="http://tcp.godaddy.com" style="color: purple; text-decoration: underline; ">tcp.godaddy.com</a>").<br><br>Even in such a case, you'll have a DNS entry such as this one:<br>_xmpp._<a href="http://tcp.godaddy.com" style="color: purple; text-decoration: underline; ">tcp.godaddy.com</a>. IN SRV 0 1 5222<span class="Apple-converted-space"> </span><a href="http://chat.godaddy.com" style="color: purple; text-decoration: underline; ">chat.godaddy.com</a>.<br>and the certificate would certainly be delivered to "<a href="http://chat.godaddy.com" style="color: purple; text-decoration: underline; ">chat.godaddy.com</a>".<br><br><o:p></o:p></span></p><pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: 'Courier New', serif; "><span lang="EN-US">-- <o:p></o:p></span></pre><pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: 'Courier New', serif; "><span lang="EN-US">Erwann ABALEA<o:p></o:p></span></pre><pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: 'Courier New', serif; "><span lang="EN-US"> </span></pre><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US">Le 07/08/2013 06:47, Wayne Thayer a écrit :<o:p></o:p></span></div></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt; "><div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US">Can anyone tell me if there is a reason not to allow an underscore (_) character in a DNSName SAN field? From what I can tell, a DNSName can contain this character, and I can do DNS queries that return public FQDNs in the format "a_b.domain.tld". A<span class="Apple-converted-space"> </span><u>host</u><span class="Apple-converted-space"> </span>name does not permit this character, so it may not work properly in a browser, but from what I can tell, some other type of service using SSL should be able to leverage an SSL certificate with this character in the SAN.<o:p></o:p></span></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US"> </span></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US">Thanks,<o:p></o:p></span></div></div><div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US"> </span></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US">Wayne<o:p></o:p></span></div></div><div><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US"> </span></div></div></div></div><p class="MsoNormal" style="margin: 0cm 0cm 12pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US"><br><br><o:p></o:p></span></p><pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: 'Courier New', serif; "><span lang="EN-US">_______________________________________________<o:p></o:p></span></pre><pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: 'Courier New', serif; "><span lang="EN-US">Public mailing list<o:p></o:p></span></pre><pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: 'Courier New', serif; "><span lang="EN-US"><a href="mailto:Public@cabforum.org" style="color: purple; text-decoration: underline; ">Public@cabforum.org</a><o:p></o:p></span></pre><pre style="margin: 0cm 0cm 0.0001pt; font-size: 10pt; font-family: 'Courier New', serif; "><span lang="EN-US"><a href="https://cabforum.org/mailman/listinfo/public" style="color: purple; text-decoration: underline; ">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></span></pre></blockquote><div style="margin: 0cm 0cm 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; "><span lang="EN-US"> </span></div></div></div>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org" style="color: purple; text-decoration: underline; ">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" style="color: purple; text-decoration: underline; ">https://cabforum.org/mailman/listinfo/public</a><br></div></blockquote></div><br></body></html>