<div dir="ltr">+1<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Mar 8, 2016 at 9:53 AM, Ryan Sleevi <span dir="ltr"><<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">+1 - That's long been the interpretation for which we expected CAs to follow, and were surprised and dismayed there was any confusion.</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Mar 8, 2016 at 6:20 AM, Adriano Santoni <span dir="ltr"><<a href="mailto:adriano.santoni@staff.aruba.it" target="_blank">adriano.santoni@staff.aruba.it</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
<font face="Calibri">+1<br>
I would endorse.<br>
</font><div><div><br>
<div>Il 08/03/2016 15:11, Stephen Davidson
ha scritto:<br>
</div>
</div></div><blockquote type="cite"><div><div>
<div>
<p class="MsoNormal">Currently the BR address wildcard
certificates as follows:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:.5in">Wildcard
Certificate: A Certificate containing an asterisk (*) in the
left‐most position of any of the Subject Fully‐Qualified
Domain Names contained in the Certificate.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">The browsers implement this to mean “the
asterisk must ONLY be in the left‐most position and must
constitute the ENTIRE label”.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">That being said, there is some confusion
among SSL buyers about what is allowable. This probably stems
from RFC 6125 section 7.2 which first argues against wildcards
entirely, then recommends the use of the wildcard character
alone in the left-most label, but also acknowledges the other
historical wildcard variants found in other RFCs (such as
HTTPS, LDAP, IMAP) including:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:.5in">fo*.<a href="http://example.com" target="_blank">example.com</a><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in">*.*.<a href="http://example.com" target="_blank">example.com</a><u></u><u></u></p>
<p class="MsoNormal" style="margin-left:.5in"><a href="http://www.*.example.com" target="_blank">www.*.example.com</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><a href="http://crt.sh/certlint" target="_blank">crt.sh/certlint</a> (thanks Rob and Peter)
finds a handful of examples of these variants. For the sake
of clarity, I’d like to propose a simple amendment to the
wildcard definition in the BR to say:<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal" style="margin-left:.5in">Wildcard
Certificate: A Certificate containing an asterisk (*)
<u>only</u> in the left‐most <u>label, and constituting that
entire label,</u> of any of the Subject Fully‐Qualified
Domain Names contained in the Certificate.<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Thoughts? Anyone willing to join in
proposing a ballot?<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Regards, Stephen<u></u><u></u></p>
<p class="MsoNormal">QuoVadis<u></u><u></u></p>
</div>
<br>
<fieldset></fieldset>
<br>
</div></div><pre>_______________________________________________
Public mailing list
<a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a>
<a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><span><font color="#888888">
</font></span></pre><span><font color="#888888">
</font></span></blockquote><span><font color="#888888">
<br>
<div>-- <br>
<p style="font-family:Serif">
Cordiali saluti,<br>
<br>
Adriano Santoni<br>
ACTALIS S.p.A.<br>
(Aruba Group)</p>
</div>
</font></span></div>
<br>_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" rel="noreferrer" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
<br></blockquote></div><br></div>
</div></div><br>_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" rel="noreferrer" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
<br></blockquote></div><br></div>