<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>Are you suggesting _pki.shop.example.com CNAME <rnd>.cnameauth.digicert.com would be used to validate shop.example.com? <o:p></o:p></span></p><p class=MsoNormal><a name="_MailEndCompose"><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'><o:p> </o:p></span></a></p><span style='mso-bookmark:_MailEndCompose'></span><p class=MsoNormal><b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'>From:</span></b><span style='font-size:11.0pt;font-family:"Calibri",sans-serif'> Kane York [mailto:kanepyork@gmail.com] <br><b>Sent:</b> Thursday, September 8, 2016 8:32 AM<br><b>To:</b> Jeremy Rowley <jeremy.rowley@digicert.com>; Peter Bowen <pzb@amzn.com><br><b>Cc:</b> public@cabforum.org; Ryan Sleevi <rsleevi@chromium.org><br><b>Subject:</b> Re: [cabfpub] CNAME-based validation<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>I think it would be more secure, but without compromising functionality, to point<o:p></o:p></p></div><p> _<a href="http://pki.shop.example.com">pki.shop.example.com</a> CNAME <Random Value>.<a href="http://cnameauth.digicert.com">cnameauth.digicert.com</a><o:p></o:p></p><p>... , just like how a TXT record validation sets the text to a Random Value.<o:p></o:p></p><p>(Using the BR's definition of Random Value here.)<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>On Wed, Sep 7, 2016, 10:20 PM Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com">jeremy.rowley@digicert.com</a>> wrote:<o:p></o:p></p></div><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><p class=MsoNormal>Not really. No one wants to point their site to a different domain. I'm hoping we can do something where there's a set process for showing control over the domain (such as by creating sub-domains) to validate certificate issuance.<br><br>Pointing <rnd>.<a href="http://shop.example.com" target="_blank">shop.example.com</a> to <a href="http://digicert.com" target="_blank">digicert.com</a> is a whole lot better for customers than pointing <a href="http://shop.example.com" target="_blank">shop.example.com</a>.<br><br>-----Original Message-----<br>From: Peter Bowen [mailto:<a href="mailto:pzb@amzn.com" target="_blank">pzb@amzn.com</a>]<br>Sent: Wednesday, September 7, 2016 12:51 PM<br>To: Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>><br>Cc: Ryan Sleevi <<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>>; <a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a><br>Subject: Re: [cabfpub] CNAME-based validation<br><br>Jeremy,<br><br>It seems that there are two different discussions here that are getting conflated.<br><br>The first is allowing someone to confirm control of a standard domain by using a CNAME record instead of a TXT record. The process would be very similar: prepend a defined string to the domain and set the canonical name to something containing a random value.<br><br>The second is authentication with one level of indirection. I think that is already mostly covered as the Authorization Domain Name can be the result of dereferencing a CNAME pointer. So if you have:<br><br><a href="http://shop.example.com" target="_blank">shop.example.com</a> IN CNAME <a href="http://webstorehosting.webpki.com" target="_blank">webstorehosting.webpki.com</a>.<br><br>You can run the validation for <a href="http://webstorehosting.webpki.com" target="_blank">webstorehosting.webpki.com</a> using constructed email to domain contact, agreed-upon change to a website, DNS change, test certificate or TLS using random number. If this passes, then <a href="http://shop.example.com" target="_blank">shop.example.com</a> is validated.<br><br>Does that not solve your issue?<br><br>Thansk,<br>Peter<br><br><br>> On Sep 6, 2016, at 5:07 PM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>> wrote:<br>><br>> Hi Ryan,<br>><br>> Pardon my DNS ignorance, but how does the server know which CNAME record to use in this case? If shop.domain.comCNAMEs to <a href="http://digicert.com" target="_blank">digicert.com</a> and *.<a href="http://domain.com" target="_blank">domain.com</a> CNAMEs to <a href="http://google.com" target="_blank">google.com</a>, then how do you know which will resolve? There isn’t a weight/ordering preference for CNAME like there is TXT records.<br>><br>> As for how to resolve this, what if the CA generated two random numbers, holding one of the numbers in reserve. Immediately after verifying that <rnd1>.<a href="http://domain.com" target="_blank">domain.com</a> CNAME points to a validated domain, the CA can then check <rnd2>.<a href="http://domain.com" target="_blank">domain.com</a> to see if it resolves. If it resolves successfully, a wildcard DNS is in place and the domain is not validated. If the domain does not resolve, a wildcard DNS is not present and the domain is considered validated. Does this resolve your concern?<br>><br>> Jeremy<br>><br>> From: Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]<br>> Sent: Friday, September 2, 2016 7:40 PM<br>> To: Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>><br>> Cc: Peter Bowen <<a href="mailto:pzb@amzn.com" target="_blank">pzb@amzn.com</a>>; <a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a><br>> Subject: Re: [cabfpub] CNAME-based validation<br>><br>> Hi Jeremy,<br>><br>> I'm afraid you may have misread my example.<br>><br>> <a href="http://shop.example.com" target="_blank">shop.example.com</a> is a CNAME to <a href="http://paymentprovider.example.org" target="_blank">paymentprovider.example.org</a> (curse our<br>> lack of distinct TLDs). It does not resolve to <a href="http://example.net" target="_blank">example.net</a><br>><br>> On Fri, Sep 2, 2016 at 6:29 PM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>> wrote:<br>> Here’s the steps:<br>> 1) CA verifies <a href="http://example.net" target="_blank">example.net</a> using any one of the methods permitted<br>><br>> 2) CA receives request for <a href="http://shop.example.com" target="_blank">shop.example.com</a><br>><br>> 3) CA retrieves CNAME for <a href="http://shop.example.com" target="_blank">shop.example.com</a> (permitted under Authorization Domain Name definition: “The CA may use the FQDN returned from a DNS CNAME lookup as the FQDN for the purposes of domain validation”)<br>><br>> 4) CNAME causes resolution to <a href="http://example.net" target="_blank">example.net</a>.<br>><br>> 5) Example.net is verified under step 1, permitting issuance of the certificate<br>><br>><br>><br>><br>><br>><br>> From: Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]<br>> Sent: Friday, September 2, 2016 5:12 PM<br>> To: Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>><br>> Cc: Peter Bowen <<a href="mailto:pzb@amzn.com" target="_blank">pzb@amzn.com</a>>; <a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a><br>><br>> Subject: Re: [cabfpub] CNAME-based validation<br>><br>> Right, and I'm not sure that (2) sufficiently establishes that <a href="http://example.com" target="_blank">example.com</a> is authorizing the request, given wildcards.<br>><br>> I think this would be a similar concern with, say, following HTTP open redirects and saying a "200 OK" code authorizes the request - wellllll, not really.<br>><br>> I'm curious if you could expand more why you believe other methods would permit a cert to be issued in the presence of this Wildcard DNS.<br>><br>> As a concrete example:<br>> <a href="http://example.com" target="_blank">example.com</a> A [my host]<br>> *.<a href="http://example.com" target="_blank">example.com</a> CNAME <a href="http://example.net" target="_blank">example.net</a><br>> <a href="http://shop.example.com" target="_blank">shop.example.com</a> CNAME <a href="http://paymentprovider.example.org" target="_blank">paymentprovider.example.org</a><br>><br>> Under this scenario, could you explain what ways that the [<rnd>.<a href="http://example.com" target="_blank">example.com</a>] would be able to issue a cert for either <a href="http://example.com" target="_blank">example.com</a> or <a href="http://shop.example.com" target="_blank">shop.example.com</a> ? Perhaps I'm just missing the implications of the existing validation methods.<br>><br>><br>><br>><br>> On Fri, Sep 2, 2016 at 3:33 PM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>> wrote:<br>> Yes. Those are the two steps I am proposing.<br>><br>> -----Original Message-----<br>> From: Peter Bowen [mailto:<a href="mailto:pzb@amzn.com" target="_blank">pzb@amzn.com</a>]<br>> Sent: Friday, September 2, 2016 4:31 PM<br>> To: Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>><br>> Cc: Ryan Sleevi <<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>>; <a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a><br>> Subject: Re: [cabfpub] CNAME-based validation<br>><br>> I think you are talking about two different things.<br>><br>> Ryan is concerned that a customer has an existing record that is “*.<a href="http://example.com" target="_blank">example.com</a> CNAME <a href="http://vanityblogs.example.net" target="_blank">vanityblogs.example.net</a>”. If you say “if you can make a record show up at _<a href="http://309654fddb59444d8efd6d2cc98881d5.example.com" target="_blank">309654fddb59444d8efd6d2cc98881d5.example.com</a> you are validated” that is bad. Instead, you are proposing a two prong validation test:<br>><br>> 1) Confirm control of <a href="http://vanityblogs.example.net" target="_blank">vanityblogs.example.net</a>.<br>> 2) Make _<a href="http://309654fddb59444d8efd6d2cc98881d5.example.com" target="_blank">309654fddb59444d8efd6d2cc98881d5.example.com</a> point to <a href="http://vanityblogs.example.net" target="_blank">vanityblogs.example.net</a>.<br>><br>> You are proposing that passing these both would confirm control of <a href="http://example.com" target="_blank">example.com</a>, right? And this would allow getting a certificate for <a href="http://shop.example.com" target="_blank">shop.example.com</a>, correct?<br>><br>> Thanks,<br>> Peter<br>><br>> > On Sep 2, 2016, at 3:25 PM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>> wrote:<br>> ><br>> > We are talking about the same thing (wildcard DNS records).<br>> ><br>> > Examples:<br>> ><br>> > <a href="http://sleevi.example.com" target="_blank">sleevi.example.com</a> CNAME <a href="http://vdomain.com" target="_blank">vdomain.com</a> *.<a href="http://example.com" target="_blank">example.com</a> CNAME <a href="http://vdomain.com" target="_blank">vdomain.com</a><br>> > <rnd>.<a href="http://example.com" target="_blank">example.com</a> CNAME <a href="http://vdomain.com" target="_blank">vdomain.com</a><br>> ><br>> > The BRs permit verification of each of these by establishing control over <a href="http://vdomain.com" target="_blank">vdomain.com</a> (under the definition of authorization domain name).<br>> ><br>> > If *.<a href="http://example.com" target="_blank">example.com</a> can be verified this way, what is different between verifying *.<a href="http://example.com" target="_blank">example.com</a> and <rnd>.<a href="http://example.com" target="_blank">example.com</a> to verify all sub domains of <a href="http://example.com" target="_blank">example.com</a>? All the RND does is make it so the website doesn’t have to point to <a href="http://vdomain.com" target="_blank">vdomain.com</a>.<br>> ><br>> > Jeremy<br>> ><br>> > From: <a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a><br>> > [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@cabforum.org</a>]<br>> > On Behalf Of Ryan Sleevi<br>> > Sent: Friday, September 2, 2016 4:05 PM<br>> > To: Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>><br>> > Cc: <a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a><br>> > Subject: Re: [cabfpub] CNAME-based validation<br>> ><br>> > Jeremy,<br>> ><br>> > Perhaps it wasn't clear, I wasn't speaking of wildcard certificates, but wildcard DNS rules, in which all requests for a given subdomain return a preconfigured record type. While for TXT and CAA records this is quite uncommon, it's exceedingly common to have CNAME records.<br>> ><br>> > That is, both <rnd>.<a href="http://example.com" target="_blank">example.com</a> and <a href="http://sleevi.example.com" target="_blank">sleevi.example.com</a> may both CNAME to <a href="http://example.com" target="_blank">example.com</a>, by virtue of of the host putting a rule of "*.<a href="http://example.com" target="_blank">example.com</a> 3600 CNAME <a href="http://example.com" target="_blank">example.com</a>"<br>> ><br>> > I am attempting to assert that placing the <rnd> in the subdomain is insufficient proof of authorization, and is meaningfully and tangibly different than the proof of control demonstrated in 3.2.2.4.7.<br>> ><br>> > As I read your wording, it suggests the following:<br>> > CA looks up <rnd>.<a href="http://example.com" target="_blank">example.com</a><br>> > <rnd>.<a href="http://example.com" target="_blank">example.com</a> points to <a href="http://example.com" target="_blank">example.com</a> CA sees it previously issued<br>> > a certificate for <a href="http://example.com" target="_blank">example.com</a> using one of the other methods CA<br>> > issues certificate for <rnd>.<a href="http://example.com" target="_blank">example.com</a><br>> ><br>> > That concerns me.<br>> ><br>> > Peter's rewording suggests the inverse:<br>> > CA looks up _<a href="http://certvalidation.example.com" target="_blank">certvalidation.example.com</a> _<a href="http://certvalidation.example.com" target="_blank">certvalidation.example.com</a><br>> > points (CNAMEs) to <rnd>.validation.[nameofca].com CA issues<br>> > certificate for <a href="http://example.com" target="_blank">example.com</a><br>> ><br>> > This is much less concerning.<br>> ><br>> > Could you help clarify which you intend, and for what names/purposes?<br>> ><br>> ><br>> > On Fri, Sep 2, 2016 at 2:52 PM, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>> wrote:<br>> > Wildcard domains are already allowed. We can verify Wildcard DNS because a CNAME for *.<a href="http://domain.com" target="_blank">domain.com</a> is pointing to a record previously verified. This verification method is permitted under the definition of Authorization Domain Name (where the FQDN returned by a CNAME lookup can be used to verify the requested FQDN). Although <rnd>.<a href="http://domain.com" target="_blank">domain.com</a> isn’t necessarily distinguishable from *.<a href="http://domain.com" target="_blank">domain.com</a>, the validation ends up being the same because either its considered an Authorized Domain Name (under the definition) or it was validated as a random value in this new method.<br>> ><br>> > For example:<br>> ><br>> > *.<a href="http://domain.com" target="_blank">domain.com</a> -> <a href="http://dcv.example.com" target="_blank">dcv.example.com</a> (validated under the Authorized<br>> > Domain Name section) <rnd>.<a href="http://domain.com" target="_blank">domain.com</a> -><a href="http://validation.example.com" target="_blank">validation.example.com</a><br>> > (validated under this new section)<br>> ><br>> > Because each is validated properly, tracking which exact section was used in the validation isn’t necessary.<br>> ><br>> > Jeremy<br>> ><br>> > From: Ryan Sleevi [mailto:<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>]<br>> > Sent: Friday, September 2, 2016 3:28 PM<br>> > To: Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>><br>> > Cc: <a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a><br>> > Subject: Re: [cabfpub] CNAME-based validation<br>> ><br>> ><br>> > _______________________________________________<br>> > Public mailing list<br>> > <a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br>> > <a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><br>><br><br>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p></blockquote></div></div></body></html>