<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2;">Lets hold off on a followup ballot until after I can talk to the IETF Security ADs in Chicago at the end of the month.</div><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2;"><br class=""></div><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2;">I would like us to decide exactly what handling we want for CNAME and DNAME and ensure the spec is completely clear and unambiguous. </div></div><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2;"><br class=""></div><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2;">As to what the handling should be, I think this is an area where we need the CDNs to help us. We are never going to get a perfect approach because there is an inherent loss of information in the use of CNAME. We don’t know why they are being used.</div><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2;"><br class=""></div><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2;">CNAME does have the unfortunate requirement that the DNS node be otherwise empty which limits flexibility here. We could have a rule that when processing CNAME you process the initial domain path first before following the CNAME should it exist.</div><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2;"><br class=""></div><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2;"><br class=""></div><div class=""><br class=""></div><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 9, 2017, at 8:38 AM, Ryan Sleevi via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><div class="gmail_extra"><br class="Apple-interchange-newline"><br class=""><div class="gmail_quote">On Thu, Mar 9, 2017 at 5:31 AM, Gervase Markham via Public<span class="Apple-converted-space"> </span><span dir="ltr" class=""><<a href="mailto:public@cabforum.org" target="_blank" class="">public@cabforum.org</a>></span><span class="Apple-converted-space"> </span>wrote:<br class=""><blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;">Hi Kirk and all,<br class=""><span class=""><br class="">On 08/03/17 22:00, Kirk Hall via Public wrote:<br class="">> The voting period for Ballot 187 has ended. Here are the results.<br class=""><br class=""></span>Thank you for tabulating these results; I'm very happy to see such a<br class="">degree of final consensus on what is, I know, a controversial issue. I<br class="">remain committed to making sure that some of the fears of some members<br class="">about abuse of this technology do not come to pass.<br class=""><br class="">There is one small "bug" in the wording which was pointed out privately<br class="">during the voting period, which I intend to fix in a quick ballot. At<br class="">the moment the text says:<br class=""><br class="">"CAs MUST respect the critical flag and reject any unrecognized<br class="">properties with this flag set."<br class=""><br class="">But this is not what should happen according to the CAA RFC. If there is<br class="">an unrecognised property with the critical flag set, the CA should not<br class="">just reject the property, they should fail closed. Here is an example of<br class="">the problems one can get from trying to reproduce the intent and<br class="">commands of an RFC in our documents, rather than just incorporating by<br class="">reference :-)<br class=""><br class="">I propose replacing the above sentence with the more accurate:<br class=""><br class="">"CAs MUST respect the critical flag and not issue a certificate if they<br class="">encounter an unrecognized property with this flag set."<br class=""><br class="">I will be preparing a ballot to this effect in the next few days.<br class="">Without reopening any of the other controversial issues related to CAA,<br class="">if anyone else has wording clarifications for this section, send me an<br class="">email.<br class=""><br class="">Gerv<br class=""></blockquote><div class=""><br class=""></div><div class="">This bug was independently discovered by another person watching the ballot and pointed out to me this morning, so I wholly support that clarification, as I'm wholly responsible for that bug :)</div><div class=""><br class=""></div><div class="">The 'intent' was very much to say "reject the certificate", as stated in 6844, but my wording of "reject any unrecognized properties" left an ambiguity that it may be acceptable to ignore such properties and issue the certificate - the very opposite of what was intended and what we'd discussed, on the list, as the goal :)</div><div class=""><br class=""></div><div class="">I'd be happy to endorse such a correction, and think we should err on the side of caution by treating it as substantive (a ballot), rather than typographical, so I appreciate your suggestion and offer to formulate such a ballot.</div></div><br class=""></div></div><span style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Public mailing list</span><br style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="mailto:Public@cabforum.org" style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">Public@cabforum.org</a><br style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="https://cabforum.org/mailman/listinfo/public" style="font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://cabforum.org/mailman/listinfo/public</a></div></blockquote></div><br class=""></body></html>