<div dir="ltr">I think that would be a highly unfortunate direction to take from this, and one that we'd have trouble supporting.</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, May 23, 2014 at 8:22 PM, Richard@WoSign <span dir="ltr"><<a href="mailto:richard@wosign.com" target="_blank">richard@wosign.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">For Wildcard certificate, I think we must limit to OV SSL only. But I found some CA issued wildcard SSL to DV, this is a big problem.<br>
<br>
<br>
Regards,<br>
<br>
Richard<br>
<div class="im HOEnZb"><br>
-----Original Message-----<br>
From: <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>] On Behalf Of Kelvin Yiu<br>
</div><div class="HOEnZb"><div class="h5">Sent: Saturday, May 24, 2014 2:49 AM<br>
To: Rick Andrews; <a href="mailto:richard.smith@comodo.com">richard.smith@comodo.com</a>; <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
Subject: Re: [cabfpub] Use of wildcard certificates by cloud operators<br>
<br>
That's correct. The cloud operator would have to meet all 4 requirements.<br>
<br>
I would like to know the type of evidence CAs would need for #1 and #2.<br>
<br>
Kelvin<br>
<br>
-----Original Message-----<br>
From: Rick Andrews [mailto:<a href="mailto:Rick_Andrews@symantec.com">Rick_Andrews@symantec.com</a>]<br>
Sent: Friday, May 23, 2014 11:01 AM<br>
To: Kelvin Yiu; <a href="mailto:richard.smith@comodo.com">richard.smith@comodo.com</a>; <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
Subject: RE: [cabfpub] Use of wildcard certificates by cloud operators<br>
<br>
Just to be clear, Kelvin, the CA SHALL revoke the cert if the cloud service provider doesn't provide evidence of ALL of the four items you listed.<br>
<br>
-Rick<br>
<br>
-----Original Message-----<br>
From: <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>] On Behalf Of Kelvin Yiu<br>
Sent: Friday, May 23, 2014 10:03 AM<br>
To: <a href="mailto:richard.smith@comodo.com">richard.smith@comodo.com</a>; <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
Subject: Re: [cabfpub] Use of wildcard certificates by cloud operators<br>
<br>
Thanks Rich.<br>
<br>
I want to make a change before moving forward with a ballot since I didn't specify any time periods in my previous draft. Here is the updated section 13.1.5.<br>
<br>
7. The CA is made aware that a Wildcard Certificate has been used to authenticate a fraudulently misleading subordinate Fully-Qualified Domain Name, except when the Subscriber is a cloud service provider. The CA SHALL revoke a Wildcard Certificate issued to cloud service provider within 5 days if the cloud service provider do not provide evidence of the following:<br>
1. Maintains a process that identifies potentially misleading subordinate domain names for additional approval<br>
2. Regularly monitors the Domain Namespace for fraudulent activities<br>
3. The fraudulent activities has been removed, or will investigate and remove the fraudulent activities within 24 hours upon notification by the CA<br>
4. Asserts that the Private Key corresponding to the Public Key in the Wildcard Certificate has not been compromised<br>
<br>
Thanks,<br>
<br>
Kelvin<br>
<br>
-----Original Message-----<br>
From: Rich Smith [mailto:<a href="mailto:richard.smith@comodo.com">richard.smith@comodo.com</a>]<br>
Sent: Friday, May 23, 2014 7:26 AM<br>
To: Kelvin Yiu; <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
Subject: RE: [cabfpub] Use of wildcard certificates by cloud operators<br>
<br>
Kelvin,<br>
Thanks, this looks good to me. I'll endorse.<br>
Regards,<br>
Rich<br>
<br>
> -----Original Message-----<br>
> From: <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>]<br>
> On Behalf Of Kelvin Yiu<br>
> Sent: Thursday, May 22, 2014 8:09 PM<br>
> To: <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
> Subject: Re: [cabfpub] Use of wildcard certificates by cloud operators<br>
><br>
> Here is my first stab at the changes. The redline version is attached.<br>
><br>
> Change the first 2 paragraphs in section 11.1.3 to:<br>
><br>
> Before issuing a certificate with a wildcard character (*) in a CN or<br>
> subjectAltName of type DNS-ID, the CA MUST establish and follow a<br>
> documented procedure† that determines if the wildcard character occurs<br>
> in the first label position to the left of a public “registry-<br>
> controlled” label (e.g. “*.com”, “*.<a href="http://co.uk" target="_blank">co.uk</a>”). CAs may consult with<br>
> “public suffix lists” to identify public “registry-controlled” domains.<br>
> See RFC 6454 Section 8.2 for further explanation).<br>
><br>
> If a wildcard would fall within the label immediately to the left of a<br>
> public “registry-controlled” domain†, CAs MUST refuse issuance unless<br>
> the applicant proves its rightful control of the entire Domain<br>
> Namespace. (e.g. CAs MUST NOT issue “*.<a href="http://co.uk" target="_blank">co.uk</a>” or “*.com”, but MAY<br>
> issue “*.<a href="http://example.com" target="_blank">example.com</a>” to Example Co.). Domains registered to cloud<br>
> service providers or Internet hosting service providers are not<br>
> considered to be public if the provider maintains reasonable controls<br>
> to monitor its Domain Namespace for fraudulent activities and remove<br>
> any fraudulent Subdomains.<br>
><br>
> Change #7 of section 13.1.5 to:<br>
><br>
> 7. The CA is made aware that a Wildcard Certificate has been used to<br>
> authenticate a fraudulently misleading subordinate Fully-Qualified<br>
> Domain Name;, except when the Subscriber is a cloud service provider.<br>
> The CA SHALL revoke a Wildcard Certificate issued to cloud service<br>
> provider within nn days if the cloud service provider do not provide<br>
> evidence of the following:<br>
> a. Maintains a process that identifies potentially misleading<br>
> subordinate domain names for additional approval<br>
> b. Regularly monitors the Domain Namespace for fraudulent<br>
> activities<br>
> c. The fraudulent activities has been removed, or will<br>
> investigate and remove the fraudulent activities within nn hours upon<br>
> notification by the CA<br>
> d. Asserts that the Private Key corresponding to the Public Key<br>
> in the Wildcard Certificate has not been compromised<br>
><br>
> Thanks,<br>
><br>
> Kelvin<br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
</div></div><br>_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
<br></blockquote></div><br></div>