<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<font face="Calibri">That list cought me by surprise, as I am not
aware that we allow non-white listed email addresses. Besides, to
date we have not even started checking domain control by email....<br>
<br>
I contacted CERT to try and find out how they figured out which
CAs are "affected" and which not (apart from reading CPS's).<br>
<br>
Adriano<br>
<br>
</font><br>
<div class="moz-cite-prefix">Il 30/03/2015 12:07, Gervase Markham ha
scritto:<br>
</div>
<blockquote cite="mid:5519204C.6030907@mozilla.org" type="cite">
<pre wrap="">Hi everyone,
On 30/03/15 10:47, Sigbjørn Vik wrote:
</pre>
<blockquote type="cite">
<pre wrap="">According to <a class="moz-txt-link-freetext" href="http://www.kb.cert.org/vuls/id/591120">http://www.kb.cert.org/vuls/id/591120</a>, some issuers use
non-whitelisted email addresses to verify domain ownership.
</pre>
</blockquote>
<pre wrap="">Thanks for bringing this up. This came to Mozilla's attention over the
weekend as well. Could all CAs please check that they and their RAs are
conforming to the BRs on this issue?
BRs 11.1.1.4 say:
"11.1.1 Authorization by Domain Name Registrant
For each Fully-Qualified Domain Name listed in a Certificate, the CA
SHALL confirm that, as of the date the Certificate was issued, the
Applicant ... either is the Domain Name Registrant or has control over
the FQDN by:
...
4. Communicating with the Domain’s administrator using an email address
created by pre-pending ‘admin’, ‘administrator’, ‘webmaster’,
‘hostmaster’, or ‘postmaster’ in the local part, followed by the at-sign
(“@”), followed by the Domain Name, which may be formed by pruning zero
or more components from therequested FQDN"
Mozilla believes the BRs are clear here: it is not acceptable to issue
certs using email confirmation where the email address is not either in
the relevant parts of WHOIS or has a localpart which exactly matches one
of those five options.
Gerv
_______________________________________________
Public mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Public@cabforum.org">Public@cabforum.org</a>
<a class="moz-txt-link-freetext" href="https://cabforum.org/mailman/listinfo/public">https://cabforum.org/mailman/listinfo/public</a>
</pre>
</blockquote>
<br>
<div class="moz-signature">-- <br>
<i><span style="font-family: Serif">Adriano Santoni</span></i> </div>
</body>
</html>