<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Resent from my DocuSign email address :/</div>
<br class="">
<div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Cordialement,</div>
<div class="">Erwann Abalea</div>
</div>
</div>
<br class="">
<div style="">
<blockquote type="cite" class="">
<div class="">Le 21 mars 2016 à 15:50, Erwann Abalea <<a href="mailto:erwann.abalea@opentrust.com" class="">erwann.abalea@opentrust.com</a>> a écrit :</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Bonjour,</div>
<div class=""><br class="">
</div>
<div class="">X.509 has recently changed its definition of what is admissible in a dNSName entry. You can freely download all this from <a href="https://www.itu.int/rec/T-REC-X.509/en" class="">https://www.itu.int/rec/T-REC-X.509/en</a>.</div>
<div class=""><br class="">
</div>
<div class="">From the very first edition of X.509v3 (1997) up to the latest revision (2012), it was defined as:</div>
<div class="">
<div class="page" title="Page 41">
<div class="layoutArea">
<div class="column">
<ul style="list-style-type: none" class="">
<li class="">
<p class=""><span style="font-size: 10.000000pt; font-family: 'TimesNewRoman'" class="">the
</span><span style="font-size: 9.000000pt; font-family: 'Courier'; font-weight: 700" class="">dNSName
</span><span style="font-size: 10.000000pt; font-family: 'TimesNewRoman'" class="">alternative is an Internet domain name defined in accordance with IETF RFC 1035; </span></p>
</li></ul>
</div>
</div>
</div>
</div>
<div class="">preventing the use of anything other than letters, digits, and hyphen.</div>
<div class=""><br class="">
</div>
<div class="">A published corrigendum changed the definition to:</div>
<blockquote style="margin: 0 0 0 40px; border: none; padding: 0px;" class="">
<div class="">
<div class="page" title="Page 6">
<div class="layoutArea">
<div class="column">
<p class=""><span style="font-size: 10.000000pt; font-family: 'Times New Roman'" class="">the
</span><span style="font-size: 9.000000pt; font-family: 'Courier New,Bold'" class="">dNSName
</span><span style="font-size: 10.000000pt; font-family: 'Times New Roman'" class="">alternative shall be a fully-qualified domain name (FQDN). The domain name shall be in the syntax as specified by section 2.3.1 of IETF RFC 5890 meaning that a domain name
is a sequence of labels in the letters, digits, hyphen (LDH) format separated by dots.
</span></p>
</div>
</div>
</div>
</div>
<div class="">
<div class="page" title="Page 6">
<div class="layoutArea">
<div class="column">
<p class=""><span style="font-size: 10.000000pt; font-family: 'Times New Roman'" class="">A label may be in one of two formats:
</span></p>
</div>
</div>
</div>
</div>
<span style="font-size: 10.000000pt; font-family: 'Times New Roman'" class="">a) All characters in the label are from the Basic Latin collection as defined by ISO/IEC 10646 (i.e., having code points in the ranges 002D, 0030-0039, 0041-005A and 0061-007A) and
it does not start with "xn--". The maximum length is 63 octets.<br class="">
</span><span style="font-size: 10.000000pt; font-family: 'Times New Roman'" class="">b) It is an A-label as defined in IETF RFC 5890, i.e., it starts with the "xn--" and is a U-label converted to valid ASCII characters as in item a) using the Punycode algorithm
defined by IETF RFC 3492. The converted string shall be maximum 59 octets. To be valid, it shall be possible for an A-label to be converted to a valid U-label. The U-label is as also defined in IETF RFC 5890.
</span>
<div class="">
<div class="page" title="Page 6">
<div class="layoutArea">
<div class="column">
<p class=""><span style="font-size: 9.000000pt; font-family: 'Times New Roman'" class="">NOTE 1
</span><span style="font-size: 9.000000pt; font-family: 'Times New Roman'" class="">–
</span><span style="font-size: 9.000000pt; font-family: 'Times New Roman'" class="">An A-label is normally not human-readable. </span></p>
</div>
</div>
</div>
</div>
</blockquote>
<div class="">Again preventing anything other than letters, digits, and hyphens.</div>
<br class="">
<div class="">
<div class="">Cordialement,</div>
<div class="">Erwann Abalea</div>
<div class=""><br class="">
</div>
<br class="Apple-interchange-newline">
</div>
<br class="">
<div class="">
<blockquote type="cite" class="">
<div class="">Le 21 mars 2016 à 14:08, Peter Bowen <<a href="mailto:pzb@amzn.com" class="">pzb@amzn.com</a>> a écrit :</div>
<br class="Apple-interchange-newline">
<div class=""><br class="">
<blockquote type="cite" class="">On Mar 21, 2016, at 4:39 AM, Gervase Markham <<a href="mailto:gerv@mozilla.org" class="">gerv@mozilla.org</a>> wrote:<br class="">
<br class="">
On 21/03/16 11:23, Rob Stradling wrote:<br class="">
<br class="">
<blockquote type="cite" class="">
<blockquote type="cite" class="">Are the things we put in certificates hostnames? Given that SSL is for<br class="">
connecting to internet hosts, it would seem to me that they are. Clue me<br class="">
in by explaining what I'm missing.<br class="">
</blockquote>
<br class="">
"You've entered a special hell. It is dark and scary. You are likely to<br class="">
be eaten by a grue."<br class="">
<br class="">
<a href="https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg02548.html" class="">https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg02548.html</a><br class="">
</blockquote>
<br class="">
Can someone give me a concrete example of why someone would want an _ in<br class="">
a hostname in a cert? An all-Microsoft shop using it for an internal<br class="">
name which nevertheless was an FQDN? my_server.corp.fooco.com?<br class="">
</blockquote>
<br class="">
_ is allowed at the DNS protocol level, so it works in many cases. See the following (pulled from CT logs):<br class="">
<br class="">
myaccount_ca.kelloggsnutrition.com<br class="">
office_eygelshoven.laurametaal.nl<br class="">
dr_mail.ncr.com<br class="">
<br class="">
All of these have public A records with what appear to be public IPs. Given this, they presumably work with many TLS clients.<br class="">
<br class="">
Thanks,<br class="">
Peter<br class="">
_______________________________________________<br class="">
Public mailing list<br class="">
<a href="mailto:Public@cabforum.org" class="">Public@cabforum.org</a><br class="">
<a href="https://cabforum.org/mailman/listinfo/public" class="">https://cabforum.org/mailman/listinfo/public</a><br class="">
<br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
</blockquote>
</div>
<br class="">
</body>
</html>