<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class="">I was wondering about that. We seem to be trying to redefine the DNS without referencing its foundational documents. How about:</div><div class=""><br class=""></div><div class="">Domain Label: A label of a domain name, as defined in RFC 1034.</div><div class="">Domain Name: A string which is a ‘domain name’ as defined in RFC 1034 with labels separated by dots, or a Wildcard Domain Name.</div><div class="">Domain Namespace (of a domain): All domains which are subdomains of the referenced domain, as described in RFC 1034.</div><div class="">Fully Qualified Domain Name: A domain name interpreted relative to the root. The Fully Qualified Domain Names used in this document do not end with a period.</div><div class="">Wildcard Domain Name: The string ‘*.’ followed by a ‘domain name’ with labels separated by dots as defined in RFC 1034.</div><br class=""><div><blockquote type="cite" class=""><div class="">On 17 Jul 2017, at 3:28 pm, Kirk Hall via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Here are the difficulties I’m having understanding the new (very complex) Ballot 202 definitions shown below. I can’t imagine explaining this to our engineering and vetting teams, and I think people will make mistakes. Assuming these definitions parse out, at a bare minimum we should give easy examples for each definition. These are arranged in a logical order, not alphabetically.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Also – we won’t really know if these definitions are good and useful unless we compare them to the new text of BR 3.2.2.4, which defines how we are to do validation. Last week when we pulled back Ballot 190 it was to allow Peter time to tune up the definition of Authorized Domain Name in Ballot 190 the context of BR 3.2.2.4 (so we could remove the Notes that had been added to Ballot 190), but to my surprise, the new definitions have shown up in Ballot 202 instead – I think that’s a mistake. <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><p class="MsoNormal" style="margin: 0in 0in 8pt; line-height: 15.399999618530273px; font-size: 11pt; font-family: Calibri, sans-serif; background-color: white; background-position: initial initial; background-repeat: initial initial;">As recently as July 4, Ben said this Ballot 202 would cover the following four subjects: (1) adds dnQualifier as an allowed attribute for all certificate types (including DV), (2) adds ASN.1 info on the EV jurisdiction attribute types, (3) adds language to the EV guidelines to clarify that CAs may limit their aggregate liabilities, (4) allows underscores in domain names and clarifies what can go in common names. Why did the authors decide to include changes to crucial definitions applicable to domain validation at the same time, but not allow discussion in a pre-ballot?<o:p class=""></o:p></p><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class="">At this point, Entrust is inclined to vote no – not because we necessarily oppose the ballot’s aims, but because there are some questions and no time to resolve them before voting starts.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Here are our concerns about the new definitions. Again, it would be nice to have more time to discuss, and not start voting on Wednesday.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">Domain Label:<span class="Apple-converted-space"> </span></b>An individual component of a Domain Name. <span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">[What does this mean – “component”? Is a period a Domain Label? A couple of letters? This seems circular with the Domain Name definition below. Did you mean “node” and not “component”? At a minimum, give examples – “In<span class="Apple-converted-space"> </span><a href="http://mail.example.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">mail.example.com</a>, the components are “mail”, “example”, and “com”. The period “.” is not a component, nor are characters that are less than a full node such as “exa”.]<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><o:p class=""> </o:p></b></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">Domain Name: <span class="Apple-converted-space"> </span></b>A set of one or more Domain Labels, each separated by a single full stop character ("."). Fully-Qualified Domain Names and Wildcard Domain Names are Domain Names. <o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">[Again, somewhat circular – Domain Label says it’s a component of a Domain Name, and Domain Name says it’s made up of Domain Labels… never fully defined. <o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">Also, saying that FQDNs and Wildcard DNs are DNs might work, but need to study the rest of the text. <o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">Also, this definition does not require a domain name to end in a gTLD or ccTLD, so server1.mail qualifies as a Domain Name? Might cause trouble with other definitions.]<b class=""><o:p class=""></o:p></b></span></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><o:p class=""> </o:p></b></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">Domain Namespace:</b> The set of all possible Domain Names that are subordinate to a single node in the Domain Name System.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">[Unclear – “subordinate to a single node in the Domain Name System”. So for<span class="Apple-converted-space"> </span><a href="http://server1.mail.example.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">server1.mail.example.com</a>, is “com” part of the Domain Namespace, or only server1.mail.example? Also, you say in the definition of Domain Name that an FQDN is a Domain Name, so under the Definition of Domain Namespace, is the entire FQDN (including .com) meant to be subordinate to a single node in the Domain Name System? Would that require<span class="Apple-converted-space"> </span><a href="http://server1.mail.example.com.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">server1.mail.example.com.</a><b class=""><a href="http://server1.mail.example.com.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">com</a></b>, with the second “.com” being the single node?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">In the example<span class="Apple-converted-space"> </span><a href="http://server1.mail.example.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">server1.mail.example.com</a>, “server1” and “mail” are subordinate to “example”, so does that mean “server1.mail” is a Domain Namespace that is subordinate to the node “example”?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">Also – we never use Domain Namespace in the rest of the definitions. Where is it used, and does this definition make sense there?]<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">Fully-Qualified Domain Name: <span class="Apple-converted-space"> </span></b>A Domain Name that includes the Domain Labels of all superior nodes in the Internet Domain Name System.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">[Again unclear. The reference to “all superior nodes” begs the question – superior to what? A gTLD or ccTLD? In the example<span class="Apple-converted-space"> </span><a href="http://server1.mail.example.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">server1.mail.example.com</a>, is “server1.mail.example” itself an FQDN, because it includes all “superior nodes” to .com? Or did you mean to include .com as well to make it an FQDN?]<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><o:p class=""> </o:p></b></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">Wildcard Domain Name:</b><span class="Apple-converted-space"> </span>A Domain Name consisting of a single asterisk character ("*") followed by a single full stop character (".") followed by a Fully-Qualified Domain Name.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">[This is confusing because it starts with Domain Name, then talks about an FQDN – the “*” itself doesn’t turn a Domain Name into an FQDN so why are you using both terms? ]<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">Base Domain Name:</b><span class="Apple-converted-space"> </span>The portion of an applied-for Domain Name that is the first domain name node left of a registry-controlled or public suffix plus the registry-controlled or public suffix (e.g. "<a href="http://example.co.uk/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">example.co.uk</a>" or "<a href="http://example.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">example.com</a>").<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class="">For Domain Names where the right-most domain name node is a gTLD having ICANN Specification 13 in its registry agreement, the gTLD itself may be used as the Base Domain Name.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">[Ballot 190 stripped out “requested” in front of FQDN wherever it existed, as it seems to get into a CA’s business processes – what the customer requests, as opposed to a domain the CA decides to validate - and adds nothing but confusion. I recall discussion that used the word “requested” to limit what a CA could do – e.g., using “requested” might limit CA so they could only verify an FQDN the customer “requested” (<a href="http://server1.mail.example.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">server1.mail.example.com</a>) and not the FQDN the CA wanted to verify to fill the customer’s order (<a href="http://example.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">example.com</a>). Now we see the words “applied for” – take it out, it’s not relevant and could restrict what CAs can do.]<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">Authorization Domain Name:</b><span class="Apple-converted-space"> </span>The Domain Name used to obtain<span class="Apple-converted-space"> </span><span style="background-color: yellow; background-position: initial initial; background-repeat: initial initial;" class="">authorization</span><span class="Apple-converted-space"> </span>for certificate issuance for a given Domain Name.<span class="Apple-converted-space"> </span><o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The CA may use the FQDN returned from a DNS CNAME lookup as the Domain Name for the purposes of domain validation.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class="">If the Domain Name is a Wildcard Domain Name, then the CA MUST remove “*.” from the left most portion of<span class="Apple-converted-space"> </span><span style="background-color: yellow; background-position: initial initial; background-repeat: initial initial;" class="">requested</span><span class="Apple-converted-space"> </span>Domain Name.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The CA may prune zero or more labels from left to right until encountering a Base Domain Name and may use any one of the intermediate values for the purpose of domain validation.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">[First, the word “authorization” does not seem correct – validation (used in BR 3.2.2.4) might make more sense. A simple WhoIs lookup by itself doesn’t seem like authorization, only validation of a request.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">The first sentence is somewhat circular by using Domain Name twice in one sentence. The Domain Name used… for a given Domain Name. ??<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">Assuming that server1.mail is a Domain Name, can it be an Authorization Domain Name for something?<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">The second sentence again goes from FQDN to Domain Name – not clear why.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">The third sentence again talks about the “requested Domain Name” – requested by the customer? Please remove “requested”. Also, why are you saying the * must be removed – do you mean to add something at the end of the sentence like “before the validation is obtained”, or “before a certificate is issued”, or..? I don’t understand the purpose of this sentence in this definition.<o:p class=""></o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in 0in 0.0001pt 0.5in; line-height: normal; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><span style="color: red;" class="">The final sentence is unclear as to what domain name is being pruned – the Authorization Domain Name? (The sentence is in that definition.) Or is the requested domain name being pruned (probably). This might be one place where it makes sense to use “requested” simply to show a CA can choose to prune and then validate what’s left. But why is this rule in the definition of Authorization Domain Name? Shouldn’t it be in BR 3.2.2.4 itself?]<o:p class=""></o:p></span></div></div><span style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">_______________________________________________</span><br style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Public mailing list</span><br style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="mailto:Public@cabforum.org" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">Public@cabforum.org</a><br style="font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><a href="https://cabforum.org/mailman/listinfo/public" style="color: rgb(149, 79, 114); text-decoration: underline; font-family: HelveticaNeue; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://cabforum.org/mailman/listinfo/public</a></div></blockquote></div><br class=""></body></html>