<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:SimSun-ExtB;
panose-1:2 1 6 9 6 1 1 1 1 1;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri","sans-serif";}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoPlainText">Ben, I have an amendment to propose, in the form of the language below (to be added at the end of your language in Sec. 8.2.2. A word of explanation: every time CAA has come up as a topic of discussion at a CAB Forum meeting or on
a call, one or more CAs and browsers have expressed concern that CAA could be used as a "blocking" strategy by CAs in order to add hurdles for another CA to sell certificates to the same customer. The main way this could happen is if a CA induces a customer
to insert its name to a CAA record when there is no CAA record at the time for the customer (or even worse, adds its name to a blank CAA record in the customer's name -- this could happen if the fine print of the Subscriber Agreement authorizes the CA to insert
its name in a CAA record for the customer and the customer has no idea this is happening). Another potential abuse would be if a CA got its name put in blank CAA records for other domains registered to the customer that are not even part of the pending certificate
order so that other CAs would find it more difficult to sell certificates for those domains.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">There seems to be strong sentiment among CAs and browsers for some language prohibiting this potential practice as anticompetitive. The decision of whether or not to even have a CAA record should be solely up to the customer, not the
CA.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">With this explanation, here is my suggestion for additional language for this pre-ballot:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoNormal" style="margin-left:.5in"><span style="color:#C00000">In order to make certain that CAA is not used by CAs in an anticompetitive manner, no CA shall (1) request or suggest that a customer include the CA’s name in a CAA record for the domain
in question if the customer does not already have a CAA record that includes the name of one or more other CAs but omits the CA’s name, (2) obtain authorization from the customer to act on the customer’s behalf (directly or by request to the customer’s DNS
operator) to create a CAA record for the customer that includes the CA’s name for the domain in question if the customer does not already have a CAA record that includes the name of one or more other CAs but omits the CA’s name, or (3) request or suggest that
a customer include the CA’s name in a CAA record for other domains not the subject of the customer’s certificate order or obtain authorization from the customer to act on the customer’s behalf (directly or by request to the customer’s DNS operator) to create
a CAA record for the customer for other domains not the subject of the customer’s certificate order.<o:p></o:p></span></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">What do you think? Does this meet everyone’s stated concerns?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">[Also – typo below – “(section 4.1 for CA’s still conforming to RFC 2527)” should be “(section 4.1 for CAs still conforming to RFC 2527)”]<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<br>
From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Ben Wilson<br>
Sent: Friday, August 29, 2014 2:02 PM<br>
To: Sigbjørn Vik; Rick Andrews; Geoff Keating; Stephen Davidson; Ryan Sleevi (sleevi@google.com)<br>
Cc: cabfpub<br>
Subject: Re: [cabfpub] Pre-Ballot 125 - CAA Records</p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Picking up where we left off .. attached is the redlined version that I think is closest to where we were on this issue:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">1. In Section 4 of the Baseline Requirements, add a definition for CAA Record as follows:
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">CAA Record: The Certification Authority Authorization (CAA) DNS Resource Record of RFC 6844<o:p></o:p></p>
<p class="MsoPlainText">(http:tools.ietf.org/html/rfc6844) that allows a DNS domain name holder to specify the Certification Authorities<o:p></o:p></p>
<p class="MsoPlainText">(CAs) authorized to issue certificates for that domain. Publication of a CAA Resource Record allows public Certification Authorities to implement additional controls to reduce the risk of unintended certificate mis-issue.<o:p></o:p></p>
<p class="MsoPlainText"> <o:p></o:p></p>
<p class="MsoPlainText">We might want to abbreviate this definition a bit.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">2. In Section 8.2.2 (instead of editing warranties in section 7.1.2 or verification practices in section 11, as some have suggested) add the following to the end of the paragraph on Disclosure:<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Effective as of [insert date that is six months from Ballot 125 adoption], section 4.2 of a CA's Certificate Policy and/or Certification Practice Statement (section 4.1 for CA’s still conforming to RFC 2527) shall<o:p></o:p></p>
<p class="MsoPlainText">disclose: (1) whether the CA reviews CAA Records, and if so, (2) the CA’s policy or practice on processing CAA Records and comparing them with proposed Domain Names for the Common Name field or Subject Alternative Name fields of certificates
applications, and (3) any actions taken as result of such comparison.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Any comments or suggestions are welcome. <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">-----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">From: public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] On Behalf Of Sigbjørn Vik<o:p></o:p></p>
<p class="MsoPlainText">Sent: Tuesday, July 22, 2014 12:47 AM<o:p></o:p></p>
<p class="MsoPlainText">To: Rick Andrews; Geoff Keating; Stephen Davidson<o:p></o:p></p>
<p class="MsoPlainText">Cc: cabfpub<o:p></o:p></p>
<p class="MsoPlainText">Subject: Re: [cabfpub] Pre-Ballot 125 - CAA Records<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On 21-Jul-14 20:11, Rick Andrews wrote:<o:p></o:p></p>
<p class="MsoPlainText">> Siggy, how does the addition of a CAA record make DoS or DNS
<o:p></o:p></p>
<p class="MsoPlainText">> amplification<o:p></o:p></p>
<p class="MsoPlainText">attacks more problematic?<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">I am no DNS expert, merely relaying comments from our sysadmin. If people with more knowledge in the field conclude that this is not an issue, that is fine with me, but it should be considered.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">> -----Original Message-----<o:p></o:p></p>
<p class="MsoPlainText">> From: Sigbjørn Vik [mailto:sigbjorn@opera.com]<o:p></o:p></p>
<p class="MsoPlainText">> Sent: Monday, July 21, 2014 12:21 AM<o:p></o:p></p>
<p class="MsoPlainText">> To: Rick Andrews; Geoff Keating; Stephen Davidson<o:p></o:p></p>
<p class="MsoPlainText">> Cc: cabfpub<o:p></o:p></p>
<p class="MsoPlainText">> Subject: Re: [cabfpub] Pre-Ballot 125 - CAA Records<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> On 17-Jul-14 23:51, Rick Andrews wrote:> Siggy,<o:p></o:p></p>
<p class="MsoPlainText">>><o:p> </o:p></p>
<p class="MsoPlainText">>> There are a number of Security Considerations in Section 6 of the CAA
<o:p></o:p></p>
<p class="MsoPlainText">>> RFC (_http://tools.ietf.org/html/rfc6844#page-13_) which detail
<o:p></o:p></p>
<p class="MsoPlainText">>> possible abuse.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> I don't see DoS or DNS amplification listed there.<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText">> --<o:p></o:p></p>
<p class="MsoPlainText">> Sigbjørn Vik<o:p></o:p></p>
<p class="MsoPlainText">> Opera Software<o:p></o:p></p>
<p class="MsoPlainText">> <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">--<o:p></o:p></p>
<p class="MsoPlainText">Sigbjørn Vik<o:p></o:p></p>
<p class="MsoPlainText">Opera Software<o:p></o:p></p>
<p class="MsoPlainText">_______________________________________________<o:p></o:p></p>
<p class="MsoPlainText">Public mailing list<o:p></o:p></p>
<p class="MsoPlainText"><a href="mailto:Public@cabforum.org"><span style="color:windowtext;text-decoration:none">Public@cabforum.org</span></a><o:p></o:p></p>
<p class="MsoPlainText"><a href="https://cabforum.org/mailman/listinfo/public"><span style="color:windowtext;text-decoration:none">https://cabforum.org/mailman/listinfo/public</span></a><o:p></o:p></p>
</div>
</body>
</html>
<table><tr><td bgcolor=#ffffff><font color=#000000><pre><table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table></pre></font></td></tr></table>