<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:0in;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma",sans-serif;
color:black;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:8.0pt;
margin-left:.5in;
line-height:105%;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
color:black;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma",sans-serif;}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle23
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle24
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle25
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body bgcolor=white lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D'>Forwarding as requested.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Jacob: Are you saying that the site operator generates and publishes the random token? The draft language requires the CA to generate this and that the site operator demonstrates domain control by making that token visible to the CA via one of the approved methods.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='color:#1F497D'><o:p> </o:p></span></a></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal'><b><span style='color:windowtext'>From:</span></b><span style='color:windowtext'> questions-bounces@cabforum.org [mailto:questions-bounces@cabforum.org] <b>On Behalf Of </b>Jacob Hoffman-Andrews<br><b>Sent:</b> Friday, November 13, 2015 2:43 PM<br><b>To:</b> Robin Alden <robin@comodo.com>; 'Tim Shirley' <TShirley@trustwave.com>; kirk_hall@trendmicro.com; questions@cabforum.org<br><b>Subject:</b> Re: [cabfquest] [cabfpub] Question 5 - Domain Validation pre-ballot<o:p></o:p></span></p></div></div><p class=MsoNormal style='margin-left:.5in'><o:p> </o:p></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in'>(sent to questions; please forward to public)<span style='font-size:12.0pt;line-height:105%'><o:p></o:p></span></p><div><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt'>On 11/13/2015 06:38 AM, Robin Alden wrote:<o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal'><span style='font-size:12.0pt;font-family:"Times New Roman",serif'>2) When a CA wishes the applicant to provide a practical demonstration of control of the domain to be certified (methods 6 & 7, lines H & J) the CA passes a value to the applicant which the applicant must then use in their demonstration of control. <o:p></o:p></span></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt'><span style='color:#1F497D'>Re-use of these values is OK, provided that the value used is unique to the applicant.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt'><span style='color:#1F497D'>This would apply for Random Values used in methods 6, 7<br>and for Request Tokens used in method 7.</span><o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt'><span style='color:#1F497D'>CAs may sometimes not be able to accurately identify whether the applicant for one certificate request is the same as the applicant for another and if that is the case then each certificate request (not just each applicant) will need a new value. This may be the case for CAs who accept certificate requests through resellers or other third parties where the identification of the applicant is handled by the reseller or third party – and so is not done within the scope of an organization audited as complying with the BRs.</span><o:p></o:p></p></blockquote><p class=MsoNormal style='mso-margin-top-alt:0in;margin-right:0in;margin-bottom:0in;margin-left:.5in;margin-bottom:.0001pt;line-height:normal'><span style='font-size:12.0pt;font-family:"Times New Roman",serif'>FYI, there is a related thread going on on the ACME mailing list: <a href="https://mailarchive.ietf.org/arch/search/?email_list=acme&gbt=1&index=F_YbbK6KDekS3rjAlHfUTc_vdZA">https://mailarchive.ietf.org/arch/search/?email_list=acme&gbt=1&index=F_YbbK6KDekS3rjAlHfUTc_vdZA</a>.<br><br>In short: For ACME DV challenges, it would be convenient for the site operator to be able to publish at a well-known URI or in DNS a list of "these accounts on CA X are authorized to issue for this domain." Such a list could include a random token, but if that random token had to vary per-authorization, it would reduce the usefulness of that construction.<o:p></o:p></span></p></div></body></html>