<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=iso-2022-jp"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:"MS PGothic";
panose-1:2 11 6 0 7 2 5 8 2 4;}
@font-face
{font-family:"\@MS Gothic";
panose-1:2 11 6 9 7 2 5 8 2 4;}
@font-face
{font-family:"\@MS PGothic";
panose-1:2 11 6 0 7 2 5 8 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-fareast-language:JA;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";
mso-fareast-language:JA;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:"Courier New";
mso-fareast-language:JA;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal><span style='color:#1F497D;mso-fareast-language:EN-US'>I agree it should be clarified, but I think we should add the text to section 7.1.4.2.1 and state that a wildcard cert is any certificate containing a wildcard character in a Subject Fully-Qualified Domain Name contained in a Certificate. Plus, we have something in 7.1.4.2.1 called a Wildcard FQDN that was never defined.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D;mso-fareast-language:EN-US'>If we amend the definition as you suggested, fo*.example.com would no longer be considered a wildcard certificate. Rather than prohibit issuance, the change would exempt fo*.example.com from the wildcard rules in the BRs and make it a normal string (because it doesn$B!G(Bt meet the wildcard definition). To make it simple, I suggest:<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D;mso-fareast-language:EN-US'>Revise the definition of a wildcard certificate:<o:p></o:p></span></p><p class=MsoNormal style='margin-left:.5in'>Wildcard Certificate: A Certificate containing an asterisk (*) in a Subject Fully$B!>(BQualified Domain Name contained in the Certificate.<o:p></o:p></p><p class=MsoNormal><span style='color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D;mso-fareast-language:EN-US'>Revise 7.1.4.2.1 as follows:<o:p></o:p></span></p><p class=MsoNormal>Contents: This extension MUST contain at least one entry. Each entry MUST be either a dNSName containing the Fully$B!>(BQualified Domain Name or an iPAddress containing the IP address of a server. The CA MUST confirm that the Applicant controls the Fully$B!>(BQualified Domain Name or IP address or has been granted the right to use it by the Domain Name Registrant or IP address assignee, as appropriate. <u>A dNSName entry MAY contain a wildcard character provided that the wildcard character constitutes the entire left most label of the FQDN and only a single wildcard character is used in each FQDN.<o:p></o:p></u></p><p class=MsoNormal><span style='color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='color:#1F497D;mso-fareast-language:EN-US'><o:p> </o:p></span></a></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> public-bounces@cabforum.org [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>Stephen Davidson<br><b>Sent:</b> Tuesday, March 8, 2016 7:11 AM<br><b>To:</b> public@cabforum.org<br><b>Subject:</b> [cabfpub] Clarifying allowed wildcard in BR<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Currently the BR address wildcard certificates as follows:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'>Wildcard Certificate: A Certificate containing an asterisk (*) in the left$B!>(Bmost position of any of the Subject Fully$B!>(BQualified Domain Names contained in the Certificate.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>The browsers implement this to mean $B!H(Bthe asterisk must ONLY be in the left$B!>(Bmost position and must constitute the ENTIRE label$B!I(B.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>That being said, there is some confusion among SSL buyers about what is allowable. This probably stems from RFC 6125 section 7.2 which first argues against wildcards entirely, then recommends the use of the wildcard character alone in the left-most label, but also acknowledges the other historical wildcard variants found in other RFCs (such as HTTPS, LDAP, IMAP) including:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'>fo*.example.com<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'>*.*.example.com<o:p></o:p></p><p class=MsoNormal style='margin-left:.5in'><a href="http://www.*.example.com">www.*.example.com</a><o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>crt.sh/certlint (thanks Rob and Peter) finds a handful of examples of these variants. For the sake of clarity, I$B!G(Bd like to propose a simple amendment to the wildcard definition in the BR to say:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal style='margin-left:.5in'>Wildcard Certificate: A Certificate containing an asterisk (*) <u>only</u> in the left$B!>(Bmost <u>label, and constituting that entire label,</u> of any of the Subject Fully$B!>(BQualified Domain Names contained in the Certificate.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thoughts? Anyone willing to join in proposing a ballot?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Regards, Stephen<o:p></o:p></p><p class=MsoNormal>QuoVadis<o:p></o:p></p></div></body></html>