<div dir="ltr">This is consistent with the deployed reality, so I similarly concur with Peter's view and believe that Phillip's understanding may be a misunderstanding of the text. Certainly, it would be a breaking change for deployments to adopt the proposed interpretation, and for that reason, would be very concerning.</div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jun 22, 2017 at 2:59 PM, Peter Bowen via Public <span dir="ltr"><<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div style="word-wrap:break-word"><div>I believe that this is a misreading, based on section 5.3:</div><div><br></div><div><pre class="m_-8519281859203594463newpage" style="font-size:13.3333px;margin-top:0px;margin-bottom:0px;font-variant-ligatures:normal"><span class="m_-8519281859203594463h3" style="line-height:0pt;display:inline;font-size:1em;font-weight:bold"><h3 style="line-height:0pt;display:inline;font-size:1em"><a class="m_-8519281859203594463selflink" name="m_-8519281859203594463_section-5.3" href="https://tools.ietf.org/html/rfc6844#section-5.3" style="color:black;text-decoration:none" target="_blank">5.3</a>. CAA issuewild Property</h3></span>
The issuewild property has the same syntax and semantics as the issue
property except that issuewild properties only grant authorization to
issue certificates that specify a wildcard domain and issuewild
properties take precedence over issue properties when specified.
Specifically:
issuewild properties MUST be ignored when processing a request for
a domain that is not a wildcard domain.
If at least one issuewild property is specified in the relevant
CAA record set, all issue properties MUST be ignored when
processing a request for a domain that is a wildcard domain.</pre><div><br></div></div><div>This makes it clear that issue property applies when a wildcard domain is processed unless there is an issuewild property.</div><div><br></div><div>Thanks,</div><div>Peter</div><br><div><blockquote type="cite"><div>On Jun 22, 2017, at 11:46 AM, Phillip via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:</div><br class="m_-8519281859203594463Apple-interchange-newline"><div><div>It is my understanding that the text as drafted prohibits issue of a<br>wildcard certificate if the record set only contains issue records and issue<br>of a non wildcard certificate if the record set only contains issuewild<br>records.<br><br>My reasoning is as follows:<br><br>The relevant parts of the specification are:<br><br>4. Certification Authority Processing<br><br> Before issuing a certificate, a compliant CA MUST check for<br> publication of a relevant CAA Resource Record set. If such a record<br> set exists, a CA MUST NOT issue a certificate unless the CA<br> determines that either (1) the certificate request is consistent with<br> the applicable CAA Resource Record set or (2) an exception specified<br> in the relevant Certificate Policy or Certification Practices<br> Statement applies.<br><br> A certificate request MAY specify more than one domain name and MAY<br> specify wildcard domains. Issuers MUST verify authorization for all<br> the domains and wildcard domains specified in the request.<br><br>3. The CAA RR Type<br><br> issue <Issuer Domain Name> [; <name>=<value> ]* : The issue property<br> entry authorizes the holder of the domain name <Issuer Domain<br> Name> or a party acting under the explicit authority of the holder<br> of that domain name to issue certificates for the domain in which<br> the property is published.<br><br> issuewild <Issuer Domain Name> [; <name>=<value> ]* : The issuewild<br> property entry authorizes the holder of the domain name <Issuer<br> Domain Name> or a party acting under the explicit authority of the<br> holder of that domain name to issue wildcard certificates for the<br> domain in which the property is published.<br><br><br>Section 4 specifies that the CA MUST NOT issue a certificate unless... 'is<br>consistent'<br><br>If we were to interpret 'is consistent' as meaning that the absence of an<br>authorization record implies authorization than the whole specification<br>becomes meaningless. The argument made that silence on issue permits<br>issuewild would apply just as well to issue. <br><br><br>Proposed resolution:<br><br>I do not believe that the text as written is ambiguous. However, 'out of an<br>abundance of caution and to eliminate any possible doubt, I propose an<br>errata to read as follows:<br><br>Existing text<br><br>4. Certification Authority Processing<br><br> Before issuing a certificate, a compliant CA MUST check for<br> publication of a relevant CAA Resource Record set. If such a record<br> set exists, a CA MUST NOT issue a certificate unless the CA<br> determines that either (1) the certificate request is consistent with<br> the applicable CAA Resource Record set or (2) an exception specified<br> in the relevant Certificate Policy or Certification Practices<br> Statement applies.<br><br>Replacement text<br><br>4. Certification Authority Processing<br><br> Before issuing a certificate, a compliant CA MUST check for<br> publication of a relevant CAA Resource Record set. If such a record<br> set exists, a CA MUST NOT issue a certificate unless the CA<br> determines that either (1) the certificate request is consistent with<br> and explicitly authorized by the applicable CAA Resource Record <br> set or (2) an exception specified in the relevant Certificate Policy <br> or Certification Practices Statement applies.<br><br><br>-----Original Message-----<br>From: Public [<a href="mailto:public-bounces@cabforum.org" target="_blank">mailto:public-bounces@<wbr>cabforum.org</a>] On Behalf Of philliph---<br>via Public<br>Sent: Thursday, June 22, 2017 10:47 AM<br>To: Gervase Markham <<a href="mailto:gerv@mozilla.org" target="_blank">gerv@mozilla.org</a>>; CA/Browser Forum Public Discussion<br>List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>Subject: Re: [cabfpub] no CAA authorizations -- RFC 6844<br><br>It was certainly the intention that presence of an issue prevents issue of<br>wildcard certs.<br><br>I will re-read that section and report.<br><br>Meanwhile, I have had some comment on the discovery fixup and will rev that.<br><br><br><blockquote type="cite">On Jun 22, 2017, at 8:34 AM, Gervase Markham via Public<br></blockquote><<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<br><blockquote type="cite"><br>On 22/06/17 06:42, y-iida--- via Public wrote:<br><blockquote type="cite"><C> Likewise, when there are some relevant CAA records, but no CAA <br>with "issuewild" property tag at all for a certificate domain, we <br>will issue wildcard certificate for that domain.<br></blockquote><br>You should read RFC6844 carefully, but to my understanding, this is <br>incorrect. If there is an "issue" property but no "issuewild" <br>property, then the "issue" property also controls the issuance of wildcard<br></blockquote>certs.<br><blockquote type="cite">So you need to respect it in that case.<br><br>Gerv<br><br>______________________________<wbr>_________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/<wbr>listinfo/public</a><br></blockquote><br>______________________________<wbr>_________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/<wbr>listinfo/public</a><br><br>______________________________<wbr>_________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/<wbr>listinfo/public</a><br></div></div></blockquote></div><br></div><br>______________________________<wbr>_________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" rel="noreferrer" target="_blank">https://cabforum.org/mailman/<wbr>listinfo/public</a><br>
<br></blockquote></div><br></div>