<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Oct 28, 2016, at 9:51 AM, Ryan Sleevi <<a href="mailto:sleevi@google.com" class="">sleevi@google.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class=""><br class=""><div class="gmail_extra"><br class=""><div class="gmail_quote">On Fri, Oct 28, 2016 at 8:01 AM, Gervase Markham via Public <span dir="ltr" class=""><<a href="mailto:public@cabforum.org" target="_blank" class="">public@cabforum.org</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">However, the expected use case for skipsubdomains=true is when CAs<br class="">
have a very particular relationship with a small number of clients who<br class="">
need high speed issuance. </blockquote><div class=""><br class=""></div><div class="">If that is the use case, then I think the onus should be on CAs wanting or representing that to show, in a timely fashion, data that would suggest this is necessary. Otherwise, it seems very much an 'uncertainty' thing, without any concrete demonstration that the overhead of the CAA check for <random>.<a href="http://thing.example.com/" class="">thing.example.com</a> would dominate any of the issuance process. </div></div></div></div></div></blockquote><br class=""></div><div>With products like the Cavium CNN3560-NFBE-G supporting more than 30,000 RSA signatures per second when using a 2048-bit key, I'm confident that the multiple DNS lookups required by CAA will be the long pole.</div><br class=""></body></html>