<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Source Sans Pro";}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
h5
{mso-style-priority:9;
mso-style-link:"Heading 5 Char";
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:10.0pt;
font-family:"Calibri",sans-serif;
font-weight:bold;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.Heading5Char
{mso-style-name:"Heading 5 Char";
mso-style-priority:9;
mso-style-link:"Heading 5";
font-family:"Calibri Light",sans-serif;
color:#2F5496;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:209348316;
mso-list-template-ids:-887165930;}
@list l1
{mso-list-id:803692010;
mso-list-template-ids:1831102806;}
@list l1:level1
{mso-level-tab-stop:.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level2
{mso-level-tab-stop:1.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level3
{mso-level-tab-stop:1.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level4
{mso-level-tab-stop:2.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level5
{mso-level-tab-stop:2.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level6
{mso-level-tab-stop:3.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level7
{mso-level-tab-stop:3.5in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level8
{mso-level-tab-stop:4.0in;
mso-level-number-position:left;
text-indent:-.25in;}
@list l1:level9
{mso-level-tab-stop:4.5in;
mso-level-number-position:left;
text-indent:-.25in;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>The BR language states the well-known directory must be “on the Authorization Domain Name”. Whether a re-direct is “on the Authorization Domain Name” is questionable. If following redirects is permitted, the language should be updated accordingly. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Jeremy<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><a name="_MailEndCompose"><o:p> </o:p></a></p><span style='mso-bookmark:_MailEndCompose'></span><p class=MsoNormal><b>From:</b> Jacob Hoffman-Andrews [mailto:jsha@letsencrypt.org] <br><b>Sent:</b> Wednesday, July 19, 2017 2:54 PM<br><b>To:</b> Paul Hoffman <paul.hoffman@icann.org>; CA/Browser Forum Public Discussion List <public@cabforum.org><br><b>Cc:</b> Jeremy Rowley <jeremy.rowley@digicert.com><br><b>Subject:</b> Re: [cabfpub] [Ext] .well-known and re-directs<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>I disagree with Paul's interpretation. At Let's Encrypt we have always followed HTTP redirects, and consider it an important part of validating by HTTP. Consider, for instance, a web site that redirects all "http:" URLs to "https:" URLs. If that site were required to inhibit redirects for validation requests, that would be harmful to the site's security.<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>My interpretation is that RFC 5785 (Well-Known URIs) doesn't need to specifically mention redirects, any more than it needs to mention Host headers, status codes, or any of the other implementation details of HTTP. According to <a href="https://tools.ietf.org/html/rfc7231#section-6.4">RFC 7231</a> (HTTP Semantics and Content):<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><pre><span style='color:black'>> The 3xx (Redirection) class of status code indicates that further<o:p></o:p></span></pre><pre><span style='color:black'>> action needs to be taken by the user agent in order to fulfill the<o:p></o:p></span></pre><pre><span style='color:black'>> request. If a Location header field (</span><a href="https://tools.ietf.org/html/rfc7231#section-7.1.2">Section 7.1.2</a><span style='color:black'>) is provided, the<o:p></o:p></span></pre><pre><span style='color:black'>> user agent MAY automatically redirect its request to the URI<o:p></o:p></span></pre><pre><span style='color:black'>> referenced by the Location field value, even if the specific status<o:p></o:p></span></pre><pre><span style='color:black'>> code is not understood.<o:p></o:p></span></pre><pre><span style='color:black'><o:p> </o:p></span></pre></div><div><p class=MsoNormal>If it was the intent of RFC 5785 or the Baseline Requirements to rule out certain HTTP semantics, that would need to be made explicit. And I think an amendment ruling out redirects would be a mistake. For reference, here's the relevant BR text:<o:p></o:p></p></div><div><h5 id=gmail-agreed-upon-change-to-website><span style='font-size:12.0pt;font-family:"Source Sans Pro"'>3.2.2.4.6 Agreed-Upon Change to Website<o:p></o:p></span></h5><p style='margin-top:5.5pt'><span style='font-family:"Times New Roman",serif'>Confirming the Applicant’s control over the requested FQDN by confirming one of the following under the “/.well-known/pki-validation” directory, or another path registered with IANA for the purpose of Domain Validation, on the Authorization Domain Name that is accessible by the CA via HTTP/HTTPS over an Authorized Port:<o:p></o:p></span></p><ol start=1 type=1><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-list:l1 level1 lfo3'><span style='font-family:"Times New Roman",serif'>The presence of Required Website Content contained in the content of a file or on a web page in the form of a meta tag. The entire Required Website Content MUST NOT appear in the request used to retrieve the file or web page, or<o:p></o:p></span></li><li class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;margin-left:0in;mso-list:l1 level1 lfo3'><span style='font-family:"Times New Roman",serif'>The presence of the Request Token or Request Value contained in the content of a file or on a webpage in the form of a meta tag where the Request Token or Random Value MUST NOT appear in the request.<o:p></o:p></span></li></ol><p style='margin-top:5.5pt'><span style='font-family:"Times New Roman",serif'>If a Random Value is used, the CA or Delegated Third Party SHALL provide a Random Value unique to the certificate request and SHALL not use the Random Value after the longer of (i) 30 days or (ii) if the Applicant submitted the certificate request, the timeframe permitted for reuse of validated information relevant to the certificate (such as in Section 3.3.1 of these Guidelines or Section 11.14.3 of the EV Guidelines).<o:p></o:p></span></p></div></div></div></body></html>