<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"Bradley Hand ITC";
panose-1:3 7 4 2 5 3 2 3 2 3;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">As we all know, internal server name certs are being phase out under BR 9.2.1. In re-reading that section plus the BR Definitions, I think our Definition of an Internal Server Name is erroneous, and reaches too far.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Right now, the definition for an ISN is as follows:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><b><span style="font-family:"Times New Roman","serif"">Internal Server Name:
</span></b><span style="font-family:"Times New Roman","serif"">A Server Name (which may or may not include an Unregistered Domain Name) that is not resolvable using the public DNS.<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><i><span style="font-family:"Times New Roman","serif""><o:p> </o:p></span></i></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><i><span style="font-family:"Times New Roman","serif"">[There is no definition of Server Name in the BRs.]<o:p></o:p></span></i></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Times New Roman","serif""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Times New Roman","serif"">[<b>Registered Domain Name:
</b>A Domain Name that has been registered with a Domain Name Registrar.]<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Times New Roman","serif"">[<b>Unregistered Domain Name:
</b>A Domain Name that is not a Registered Domain Name.]<o:p></o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><span style="font-family:"Times New Roman","serif""><o:p> </o:p></span></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none">I don’t really understand the existing definition, and I believe the definition should be
<i><u>changed</u></i> to read as follows:<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><b><span style="font-family:"Times New Roman","serif"">Internal Server Name:
</span></b><span style="font-family:"Times New Roman","serif"">A Server Name that is an Unregistered Domain Name.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none">In my opinion, whether or not a Server Name is resolvable using the public DNS is irrelevant to the definition. There are cases where a customer registers a domain name with a registrar and it can be viewed
on WhoIs, but the customer only uses the domain name for internal communications purposes, and so the Server Name / domain name is “not resolvable using the public DNS”. (Or, the customer has registered the domain but not started using it yet, but wants to
order certs for it.)<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none">Even though the domain is not resolvable using the public DNS when the cert is ordered, the domain
<i><u>can</u></i> be fully and vetted by a CA uniquely back to the customer (either through Manual Vetting that examines the WhoIs entry and matches it to the customer’s name, or through the automatic email method using one of the contact email addresses listed
in the WhoIs record). <o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none">So long as the Server Name / domain name is properly registered by a customer with a registrar (whether or not the domain is presently resolvable using the public DNS), that means a hacker can’t get a cert for
the same domain from the CA or from another CA – which is the whole point of sunsetting Internal Server Names under BR 9.2.1 (i.e., to prevent hackers from getting certs for .mail, etc. which can’t be uniquely vetted to any single domain owner).<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none">Does anyone disagree with changing the definition of Internal Server Name to read as follows?<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-autospace:none"><b><span style="font-size:10.0pt;font-family:"Times New Roman","serif"">Internal Server Name:
</span></b><span style="font-size:10.0pt;font-family:"Times New Roman","serif"">A Server Name that is an Unregistered Domain Name.<o:p></o:p></span></p>
<p class="MsoNormal" style="text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none">If not, I will propose a ballot.<o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none"><b><u>NOTE</u></b> - I am posting this on the public list so that we can receive input from all interested parties – but I understand that some CAB Forum members think my narrow question (about how to interpret
Internal Server Names for the purpose of the sunsetting under BR 9.2.1 – which today is ambiguous) is a great starting point for fixing lots of inconsistent wording in the Baseline Requirements and maybe the EV Guidelines concerning the terms “domain names,”,
“server names,” “FQDNs”, etc. <o:p></o:p></p>
<p class="MsoNormal" style="text-autospace:none"><o:p> </o:p></p>
<p class="MsoNormal" style="text-autospace:none">I’m all in favor of a comprehensive review of these other issues – but not if it delays reaching a solution to the way ISNs are defined as it may apply to BR 9.2.1. If the discussion seems to go become too broad
and will delay resolution of this narrow issue, I will likely propose a ballot soon that deals only with the definition of ISN as outlined above, and leave the rest of the work to a later ballot.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><i><span style="font-size:14.0pt;font-family:"Bradley Hand ITC","serif";color:#0F243E">Kirk R. Hall<o:p></o:p></span></i></b></p>
<p class="MsoNormal">Operations Director, Trust Services<o:p></o:p></p>
<p class="MsoNormal">Trend Micro<o:p></o:p></p>
<p class="MsoNormal">+1.503.753.3088<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>