<div dir="ltr">That seems pretty bogus. In terms of attack against the SSL connection, the whole point of the certificate is to remove the DNS as an attack vector. In terms of attack against the CA, aren't you don't the same registry-based validation of IP addresses that you are for DNS names?<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Apr 21, 2016 at 11:12 AM, Tim Hollebeek <span dir="ltr"><<a href="mailto:THollebeek@trustwave.com" target="_blank">THollebeek@trustwave.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Regardless of whether this should be allowed for public certificate, it is worth noting that it is not uncommon to use IP addresses in certificates in order to to remove DNS as an attack vector.<br>
<br>
-Tim<br>
<div><div class="h5"><br>
-----Original Message-----<br>
From: <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>] On Behalf Of Rob Stradling<br>
Sent: Thursday, April 21, 2016 10:19 AM<br>
To: <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
Cc: Rick Andrews<br>
Subject: Re: [cabfpub] Proposed new ballot on IP Addresses in SANs<br>
<br>
Why do we need to allow IP addresses in certs anyway?<br>
<br>
Are there actually any valid use cases where servers can't be addressed by domain names?<br>
<br>
On 21/04/16 15:04, Jeremy Rowley wrote:<br>
> We have and it's not practical. I'm encouraging the customers with the<br>
> issue to post to the forum to explain why.<br>
><br>
><br>
> Richard Barnes <<a href="mailto:rbarnes@mozilla.com">rbarnes@mozilla.com</a>> wrote:<br>
><br>
> Jody, Rick: Have you guys evaluated Ryan's proposed solution? It<br>
> seems a bit rash to be changing the BRs if there are compliant options that work.<br>
><br>
> On Thu, Apr 21, 2016 at 9:30 AM, Jody Cloutier <<a href="mailto:jodycl@microsoft.com">jodycl@microsoft.com</a><br>
> <mailto:<a href="mailto:jodycl@microsoft.com">jodycl@microsoft.com</a>>> wrote:<br>
><br>
> As a Forum member, Google is certainly within its purview to vote<br>
> no, then. Let's put it to a vote and see where it comes down.<br>
><br>
> ------------------------------------------------------------------------<br>
> *From:* Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a> <mailto:<a href="mailto:sleevi@google.com">sleevi@google.com</a>>><br>
> *Sent:* Thursday, April 21, 2016 6:24:55 AM<br>
> *To:* Jody Cloutier<br>
> *Cc:* Richard Barnes; Rick Andrews; <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
> <mailto:<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br>
> *Subject:* Re: [cabfpub] Proposed new ballot on IP Addresses in<br>
> SANs<br>
><br>
><br>
> On Thu, Apr 21, 2016 at 6:24 AM, Jody Cloutier <<a href="mailto:jodycl@microsoft.com">jodycl@microsoft.com</a><br>
> <mailto:<a href="mailto:jodycl@microsoft.com">jodycl@microsoft.com</a>>> wrote:<br>
><br>
> Simple - because we have customers who now need the<br>
> functionality, and without this change we cannot give it to them.<br>
><br>
><br>
> That's not correct - I gave a solution 8 months ago, fully compliant<br>
> with the BRs, that would have allowed that behaviour to be given to<br>
> them.<br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Public mailing list<br>
> <a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
</div></div>> <a href="http://scanmail.trustwave.com/?c=4062&d=xOOY18SejsrPsLSFCwFp5d2qRC1dGS" rel="noreferrer" target="_blank">http://scanmail.trustwave.com/?c=4062&d=xOOY18SejsrPsLSFCwFp5d2qRC1dGS</a><br>
> OR7jNbJCyBdA&s=5&u=https%3a%2f%2fcabforum%2eorg%2fmailman%2flistinfo%2<br>
> fpublic<br>
<span class="">><br>
<br>
--<br>
Rob Stradling<br>
Senior Research & Development Scientist<br>
COMODO - Creating Trust Online<br>
Office Tel: <a href="tel:%2B44.%280%291274.730505" value="+441274730505">+44.(0)1274.730505</a><br>
Office Fax: <a href="tel:%2B44.%280%291274.730909" value="+441274730909">+44.(0)1274.730909</a><br>
</span><a href="http://scanmail.trustwave.com/?c=4062&d=xOOY18SejsrPsLSFCwFp5d2qRC1dGSOR7jJfJCmEcQ&s=5&u=http%3a%2f%2fwww%2ecomodo%2ecom" rel="noreferrer" target="_blank">http://scanmail.trustwave.com/?c=4062&d=xOOY18SejsrPsLSFCwFp5d2qRC1dGSOR7jJfJCmEcQ&s=5&u=http%3a%2f%2fwww%2ecomodo%2ecom</a><br>
<span class=""><br>
COMODO CA Limited, Registered in England No. 04058690 Registered Office:<br>
3rd Floor, 26 Office Village, Exchange Quay,<br>
Trafford Road, Salford, Manchester M5 3EQ<br>
<br>
This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender by replying to the e-mail containing this attachment. Replies to this email may be monitored by COMODO for operational or business reasons. Whilst every endeavour is taken to ensure that e-mails are free from viruses, no liability can be accepted and the recipient is requested to use their own virus checking software.<br>
</span><span class="">_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
</span><a href="http://scanmail.trustwave.com/?c=4062&d=xOOY18SejsrPsLSFCwFp5d2qRC1dGSOR7jNbJCyBdA&s=5&u=https%3a%2f%2fcabforum%2eorg%2fmailman%2flistinfo%2fpublic" rel="noreferrer" target="_blank">http://scanmail.trustwave.com/?c=4062&d=xOOY18SejsrPsLSFCwFp5d2qRC1dGSOR7jNbJCyBdA&s=5&u=https%3a%2f%2fcabforum%2eorg%2fmailman%2flistinfo%2fpublic</a><br>
<br>
________________________________<br>
<br>
This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.<br>
<div class="HOEnZb"><div class="h5">_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" rel="noreferrer" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>
</div></div></blockquote></div><br></div>