<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
I completely agree. Until we hear from Tor and other interested
parties, there isn't a need to formulate a ballot for the exception.
However, assuming support is shown for Tor, would putting it in a
lesser used SAN entry be the best place rather than creating a
broader exception or using a different field?<br>
<br>
Jeremy<br>
<br>
<br>
<div class="moz-cite-prefix">On 10/23/2014 5:01 PM, Ryan Sleevi
wrote:<br>
</div>
<blockquote
cite="mid:CACvaWvYEx6fp70pRzJZvHnent7bbjKUTALFVG7=KCdaN=6yWVQ@mail.gmail.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<p dir="ltr">My comment was merely that its not permitted under
the BRs today, and a ballot would need to change that.</p>
<p dir="ltr">As Adam notes, it is possible to come up with unique
identification schemes, if the necessary steps are taken first
(IANA registration and a BR ballot among them).</p>
<p dir="ltr">To support a ballot, demonstration of interest from
the affected parties would be needed.</p>
<div class="gmail_quote">On Oct 23, 2014 3:52 PM, "Adam Langley"
<<a moz-do-not-send="true" href="mailto:agl@google.com">agl@google.com</a>>
wrote:<br type="attribution">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">On Thu, Oct
23, 2014 at 3:11 PM, Jeremy.Rowley<br>
<<a moz-do-not-send="true"
href="mailto:jeremy.rowley@digicert.com">jeremy.rowley@digicert.com</a>>
wrote:<br>
> Thanks Ryan. Adam didn't see as strongly opposed as you
are in this email.<br>
> Also, Adam was going to reach out to Tor and get them to
provide input. Is<br>
> that still happening?<br>
<br>
I did point them at this thread. I'm guessing that they have
lots to<br>
do I'm afraid.<br>
<br>
Issuing in a non-IANA domain is not to be done lightly and is
against<br>
the Baseline currently. However, I don't agree that this is<br>
intrinsically the same as internal names since a specific
onion<br>
address does globally, uniquely identify someone. It is
something that<br>
could, plausibly, have a certificate.<br>
<br>
But if .onion is ok, what about all the other pseudo-TLDs that
people<br>
use? If Tor want this then I wonder that they might need to
support,<br>
say, <a moz-do-not-send="true"
href="http://onion.torproject.org" target="_blank">onion.torproject.org</a>
in order to root it correctly in IANA space.<br>
Then it's a change to the Baseline validation rules, which is
still a<br>
one-off hack, but I like Tor so I don't discount it out of
hand.<br>
<br>
But without Tor fighting for it I'm not sure that there's much
hope.<br>
<br>
<br>
Cheers<br>
<br>
AGL<br>
</blockquote>
</div>
</blockquote>
<br>
</body>
</html>