<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Mon, Dec 16, 2013 at 5:52 PM, <a href="mailto:kirk_hall@trendmicro.com">kirk_hall@trendmicro.com</a> <span dir="ltr"><<a href="mailto:kirk_hall@trendmicro.com" target="_blank">kirk_hall@trendmicro.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple">
<div>
<p class="MsoNormal">As we all know, internal server name certs are being phase out under BR 9.2.1. In re-reading that section plus the BR Definitions, I think our Definition of an Internal Server Name is erroneous, and reaches too far.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Right now, the definition for an ISN is as follows:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><b><span style="font-family:"Times New Roman","serif"">Internal Server Name:
</span></b><span style="font-family:"Times New Roman","serif"">A Server Name (which may or may not include an Unregistered Domain Name) that is not resolvable using the public DNS.<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><i><span style="font-family:"Times New Roman","serif""><u></u> <u></u></span></i></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><i><span style="font-family:"Times New Roman","serif"">[There is no definition of Server Name in the BRs.]<u></u><u></u></span></i></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Times New Roman","serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Times New Roman","serif"">[<b>Registered Domain Name:
</b>A Domain Name that has been registered with a Domain Name Registrar.]<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Times New Roman","serif"">[<b>Unregistered Domain Name:
</b>A Domain Name that is not a Registered Domain Name.]<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Times New Roman","serif""><u></u> <u></u></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="text-autospace:none">I don’t really understand the existing definition, and I believe the definition should be
<i><u>changed</u></i> to read as follows:<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><b><span style="font-family:"Times New Roman","serif"">Internal Server Name:
</span></b><span style="font-family:"Times New Roman","serif"">A Server Name that is an Unregistered Domain Name.<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="text-autospace:none">In my opinion, whether or not a Server Name is resolvable using the public DNS is irrelevant to the definition. There are cases where a customer registers a domain name with a registrar and it can be viewed
on WhoIs, but the customer only uses the domain name for internal communications purposes, and so the Server Name / domain name is “not resolvable using the public DNS”. (Or, the customer has registered the domain but not started using it yet, but wants to
order certs for it.)<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="text-autospace:none">Even though the domain is not resolvable using the public DNS when the cert is ordered, the domain
<i><u>can</u></i> be fully and vetted by a CA uniquely back to the customer (either through Manual Vetting that examines the WhoIs entry and matches it to the customer’s name, or through the automatic email method using one of the contact email addresses listed
in the WhoIs record). <u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="text-autospace:none">So long as the Server Name / domain name is properly registered by a customer with a registrar (whether or not the domain is presently resolvable using the public DNS), that means a hacker can’t get a cert for
the same domain from the CA or from another CA – which is the whole point of sunsetting Internal Server Names under BR 9.2.1 (i.e., to prevent hackers from getting certs for .mail, etc. which can’t be uniquely vetted to any single domain owner).<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="text-autospace:none">Does anyone disagree with changing the definition of Internal Server Name to read as follows?<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><b><span style="font-size:10.0pt;font-family:"Times New Roman","serif"">Internal Server Name:
</span></b><span style="font-size:10.0pt;font-family:"Times New Roman","serif"">A Server Name that is an Unregistered Domain Name.</span> </p></div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="EN-US" link="blue" vlink="purple"><div><p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-size:10.0pt;font-family:"Times New Roman","serif""><u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="text-autospace:none">If not, I will propose a ballot.<u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="text-autospace:none"><b><u>NOTE</u></b> - I am posting this on the public list so that we can receive input from all interested parties – but I understand that some CAB Forum members think my narrow question (about how to interpret
Internal Server Names for the purpose of the sunsetting under BR 9.2.1 – which today is ambiguous) is a great starting point for fixing lots of inconsistent wording in the Baseline Requirements and maybe the EV Guidelines concerning the terms “domain names,”,
“server names,” “FQDNs”, etc. <u></u><u></u></p>
<p class="MsoNormal" style="text-autospace:none"><u></u> <u></u></p>
<p class="MsoNormal" style="text-autospace:none">I’m all in favor of a comprehensive review of these other issues – but not if it delays reaching a solution to the way ISNs are defined as it may apply to BR 9.2.1. If the discussion seems to go become too broad
and will delay resolution of this narrow issue, I will likely propose a ballot soon that deals only with the definition of ISN as outlined above, and leave the rest of the work to a later ballot.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><b><i><span style="font-size:14.0pt;font-family:"Bradley Hand ITC","serif";color:#0f243e">Kirk R. Hall<u></u><u></u></span></i></b></p>
<p class="MsoNormal">Operations Director, Trust Services<u></u><u></u></p>
<p class="MsoNormal">Trend Micro<u></u><u></u></p>
<p class="MsoNormal"><a href="tel:%2B1.503.753.3088" value="+15037533088" target="_blank">+1.503.753.3088</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</div>
</div>
<table><tbody><tr><td bgcolor="#ffffff"><font color="#000000"><pre><table><tbody><tr><td><pre>TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></tbody></table></pre></font></td></tr></tbody></table>
<br>_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
<br></blockquote></div><br></div><div class="gmail_extra">Thanks for raising this issue, Kirk. This has indeed been a source of confusion for some.</div><div class="gmail_extra"><br></div><div class="gmail_extra">Within Chromium's implementation, we've long interpreted Internal Server Name exactly as you describe, and that has been our primary concern with the deprecation of such names.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">The one caveat I would propose that, as we seek to improve wording, we also ensure that the name that has been registered with a Domain Name Registar authorized by the ICANN-assigned Registry for that domain name space.</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">The only reason I highlight this is that there exists the reality of "alternative Domain Name Systems" that seek to replace or ignore the ICANN-defined registration process, and I would hate to see a CA use such a system as a "reliable data source".</div>
<div class="gmail_extra"><br></div><div class="gmail_extra">That is, we have zero security concerns or objections with CAs issuing certificates for so-called "split-horizon" DNS namespaces, provided that the CA has performed the required due diligence to ensure that the requester of such certificates are authorized to request such certificates within the registerable portion of that domain name space (aka, Section 11.1)</div>
<div class="gmail_extra"><br></div></div>