<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
{mso-style-priority:99;
mso-style-link:"Balloon Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:8.0pt;
font-family:"Tahoma","sans-serif";}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.BalloonTextChar
{mso-style-name:"Balloon Text Char";
mso-style-priority:99;
mso-style-link:"Balloon Text";
font-family:"Tahoma","sans-serif";}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I’m just saying I’ve seen people do it, often on networks or machines where there isn’t even a DNS server configured or available.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">-Tim<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> Richard Barnes [mailto:rbarnes@mozilla.com]
<br>
<b>Sent:</b> Thursday, April 21, 2016 11:20 AM<br>
<b>To:</b> Tim Hollebeek<br>
<b>Cc:</b> Rob Stradling; public@cabforum.org; Rick Andrews<br>
<b>Subject:</b> Re: [cabfpub] Proposed new ballot on IP Addresses in SANs<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">That seems pretty bogus. In terms of attack against the SSL connection, the whole point of the certificate is to remove the DNS as an attack vector. In terms of attack against the CA, aren't you don't the same registry-based validation
of IP addresses that you are for DNS names?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Apr 21, 2016 at 11:12 AM, Tim Hollebeek <<a href="mailto:THollebeek@trustwave.com" target="_blank">THollebeek@trustwave.com</a>> wrote:<o:p></o:p></p>
<p class="MsoNormal">Regardless of whether this should be allowed for public certificate, it is worth noting that it is not uncommon to use IP addresses in certificates in order to to remove DNS as an attack vector.<br>
<br>
-Tim<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal"><br>
-----Original Message-----<br>
From: <a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a> [mailto:<a href="mailto:public-bounces@cabforum.org">public-bounces@cabforum.org</a>] On Behalf Of Rob Stradling<br>
Sent: Thursday, April 21, 2016 10:19 AM<br>
To: <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
Cc: Rick Andrews<br>
Subject: Re: [cabfpub] Proposed new ballot on IP Addresses in SANs<br>
<br>
Why do we need to allow IP addresses in certs anyway?<br>
<br>
Are there actually any valid use cases where servers can't be addressed by domain names?<br>
<br>
On 21/04/16 15:04, Jeremy Rowley wrote:<br>
> We have and it's not practical. I'm encouraging the customers with the<br>
> issue to post to the forum to explain why.<br>
><br>
><br>
> Richard Barnes <<a href="mailto:rbarnes@mozilla.com">rbarnes@mozilla.com</a>> wrote:<br>
><br>
> Jody, Rick: Have you guys evaluated Ryan's proposed solution? It<br>
> seems a bit rash to be changing the BRs if there are compliant options that work.<br>
><br>
> On Thu, Apr 21, 2016 at 9:30 AM, Jody Cloutier <<a href="mailto:jodycl@microsoft.com">jodycl@microsoft.com</a><br>
> <mailto:<a href="mailto:jodycl@microsoft.com">jodycl@microsoft.com</a>>> wrote:<br>
><br>
> As a Forum member, Google is certainly within its purview to vote<br>
> no, then. Let's put it to a vote and see where it comes down.<br>
><br>
> ------------------------------------------------------------------------<br>
> *From:* Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a> <mailto:<a href="mailto:sleevi@google.com">sleevi@google.com</a>>><br>
> *Sent:* Thursday, April 21, 2016 6:24:55 AM<br>
> *To:* Jody Cloutier<br>
> *Cc:* Richard Barnes; Rick Andrews; <a href="mailto:public@cabforum.org">public@cabforum.org</a><br>
> <mailto:<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br>
> *Subject:* Re: [cabfpub] Proposed new ballot on IP Addresses in<br>
> SANs<br>
><br>
><br>
> On Thu, Apr 21, 2016 at 6:24 AM, Jody Cloutier <<a href="mailto:jodycl@microsoft.com">jodycl@microsoft.com</a><br>
> <mailto:<a href="mailto:jodycl@microsoft.com">jodycl@microsoft.com</a>>> wrote:<br>
><br>
> Simple - because we have customers who now need the<br>
> functionality, and without this change we cannot give it to them.<br>
><br>
><br>
> That's not correct - I gave a solution 8 months ago, fully compliant<br>
> with the BRs, that would have allowed that behaviour to be given to<br>
> them.<br>
><br>
><br>
><br>
><br>
> _______________________________________________<br>
> Public mailing list<br>
> <a href="mailto:Public@cabforum.org">Public@cabforum.org</a><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">> <a href="http://scanmail.trustwave.com/?c=4062&d=xOOY18SejsrPsLSFCwFp5d2qRC1dGS" target="_blank">
http://scanmail.trustwave.com/?c=4062&d=xOOY18SejsrPsLSFCwFp5d2qRC1dGS</a><br>
> OR7jNbJCyBdA&s=5&u=https%3a%2f%2fcabforum%2eorg%2fmailman%2flistinfo%2<br>
> fpublic<br>
><br>
<br>
--<br>
Rob Stradling<br>
Senior Research & Development Scientist<br>
COMODO - Creating Trust Online<br>
Office Tel: <a href="tel:%2B44.%280%291274.730505">+44.(0)1274.730505</a><br>
Office Fax: <a href="tel:%2B44.%280%291274.730909">+44.(0)1274.730909</a><br>
<a href="http://scanmail.trustwave.com/?c=4062&d=uu-Y197oZPRBaw1WEzsJAoqUYzTDlh95SJn-8yyTPg&s=5&u=http%3a%2f%2fwww%2ecomodo%2ecom" target="_blank">http://scanmail.trustwave.com/?c=4062&d=xOOY18SejsrPsLSFCwFp5d2qRC1dGSOR7jJfJCmEcQ&s=5&u=http%3a%2f%2fwww%2ecomodo%2ecom</a><br>
<br>
COMODO CA Limited, Registered in England No. 04058690 Registered Office:<br>
3rd Floor, 26 Office Village, Exchange Quay,<br>
Trafford Road, Salford, Manchester M5 3EQ<br>
<br>
This e-mail and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender by replying to the e-mail containing this
attachment. Replies to this email may be monitored by COMODO for operational or business reasons. Whilst every endeavour is taken to ensure that e-mails are free from viruses, no liability can be accepted and the recipient is requested to use their own virus
checking software.<br>
_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="http://scanmail.trustwave.com/?c=4062&d=uu-Y197oZPRBaw1WEzsJAoqUYzTDlh95SJj68ymWOw&s=5&u=https%3a%2f%2fcabforum%2eorg%2fmailman%2flistinfo%2fpublic" target="_blank">http://scanmail.trustwave.com/?c=4062&d=xOOY18SejsrPsLSFCwFp5d2qRC1dGSOR7jNbJCyBdA&s=5&u=https%3a%2f%2fcabforum%2eorg%2fmailman%2flistinfo%2fpublic</a><br>
<br>
________________________________<br>
<br>
This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information
contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.<o:p></o:p></p>
<div>
<div>
<p class="MsoNormal">_______________________________________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="http://scanmail.trustwave.com/?c=4062&d=uu-Y197oZPRBaw1WEzsJAoqUYzTDlh95SJj68ymWOw&s=5&u=https%3a%2f%2fcabforum%2eorg%2fmailman%2flistinfo%2fpublic" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p>
</div>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
This transmission may contain information that is privileged, confidential, and/or exempt from disclosure under applicable law. If you are not the intended recipient, you are hereby notified that any disclosure, copying, distribution, or use of the information
contained herein (including any reliance thereon) is strictly prohibited. If you received this transmission in error, please immediately contact the sender and destroy the material in its entirety, whether in electronic or hard copy format.<br>
</font>
</body>
</html>