<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from rtf -->
<style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<font face="Calibri, sans-serif" size="2">
<div>Siggy,</div>
<div> </div>
<div>There are a number of Security Considerations in Section 6 of the CAA RFC (<a href="http://tools.ietf.org/html/rfc6844#page-13"><font color="#0000FF"><u>http://tools.ietf.org/html/rfc6844#page-13</u></font></a>) which detail possible abuse.</div>
<div> </div>
<div>Stephen,</div>
<div> </div>
<div>Are you ok with Ben's proposed language that he proposed on June 27?</div>
<div> </div>
<div style="margin-bottom: 6pt; text-align: justify; "><font face="Calibri, sans-serif"><b>2. Authorization for Certificate:</b> That, at the time of issuance, the CA (i) implemented a procedure for verifying that the Subject authorized the issuance of the
Certificate and that the Applicant Representative is authorized to request the Certificate on behalf of the Subject; (ii) followed the procedure when issuing the Certificate; and (iii) accurately described the procedure in the CA’s Certificate Policy and/or
Certification Practice Statement<u>, which, effective as of [insert date that is six months from Ballot 125 adoption], SHALL set forth in Section 4.2 whether the CA reviews CAA records, and if so, the CA’s policy on processing CAA records for all Domain Names
in Common Names and all Subject Alternative Name fields to be included in a Certificate</u>.” </font></div>
<div> </div>
<div>-Rick</div>
<div> </div>
<div>-----Original Message-----<br>
From: Sigbjørn Vik [<a href="mailto:sigbjorn@opera.com">mailto:sigbjorn@opera.com</a>]
<br>
Sent: Wednesday, July 16, 2014 12:49 AM<br>
To: Rick Andrews; Geoff Keating; Stephen Davidson<br>
Cc: cabfpub<br>
Subject: Re: [cabfpub] Pre-Ballot 125 - CAA Records</div>
<div> </div>
<div>> *On Behalf Of *Geoff Keating</div>
<div>> In actual use there should be no problem since real queries (as </div>
<div>> opposed to those intended for DoS) will not ask for the CAA record and </div>
<div>> so won't get it.</div>
<div> </div>
<div>When implementing this, we do need to bear in mind the potential for abuse as well.</div>
<div> </div>
<div>--</div>
<div>Sigbjørn Vik</div>
<div>Opera Software</div>
<div> </div>
</font>
</body>
</html>