<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle23
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1736051948;
mso-list-type:hybrid;
mso-list-template-ids:-1257354086 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>The attack vector is easier than that. <o:p></o:p></p><ol style='margin-top:0in' start=1 type=1><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo1'>I use very stringent processes to verify that Google, Inc. is a legit company in Utah.<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo1'>I verify that Jeremy did indeed incorporate Google, Inc. <o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo1'>I call Jeremy at the phone listed for Google, Inc., the Utah corporation<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo1'>The domain information shows Google, Inc. as owning google.com<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo1'>Certificate issues.<o:p></o:p></li></ol><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Obviously this would be caught in every CA’s high risk checks, but the point remains valid. Regardless of the expertise and thoroughness of the org check, the specs lack any time between the verified org and the actual domain because orgs are not unique on a global basis.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Jeremy<o:p></o:p></p><p class=MsoNormal><a name="_MailEndCompose"><o:p> </o:p></a></p><span style='mso-bookmark:_MailEndCompose'></span><p class=MsoNormal><b>From:</b> Public [mailto:public-bounces@cabforum.org] <b>On Behalf Of </b>Ryan Sleevi via Public<br><b>Sent:</b> Thursday, December 21, 2017 9:58 AM<br><b>To:</b> Adriano Santoni <adriano.santoni@staff.aruba.it>; CA/Browser Forum Public Discussion List <public@cabforum.org><br><b>Subject:</b> Re: [cabfpub] Verification of Domain Contact and Domain Authorization Document<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>Adriano,<o:p></o:p></p><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Do you have an example of how you believe 3.2.2.4.1 can be used correctly? <o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Specifically, it does not describe the process for validating that the Applicant is the Domain Contact with the Registrar - this isn't equivalent to using WHOIS.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Here's just one scenario:<o:p></o:p></p></div><div><p class=MsoNormal>- I ("Ryan Sleevi") apply to Foo CA for <a href="http://example.com">example.com</a>, which is owned by "Andriano Santoni's Lightly Validated Certificates" - you.<o:p></o:p></p></div><div><p class=MsoNormal>- Foo CA decides to employ 3.2.2.4.1, using 3.2.2.4(1)<o:p></o:p></p></div><div><p class=MsoNormal> - Note, as worded, all of 3.2.2.1 can be read as 'optional' for DV certs, thus automatically met, but lets pretend its OV<o:p></o:p></p></div><div><p class=MsoNormal> - They verify "Andriano Santoni's Lightly Validated Certificates" is a real company with a real existence using a QGIS. That's all that's needed - there's no binding to the Applicant, just an existence proof of the data.<o:p></o:p></p></div><div><p class=MsoNormal> - Alternatively, I send a photoshopped letter claiming your company exists, valid under 3.2.2.1(4)<o:p></o:p></p></div><div><p class=MsoNormal> - Alternatively, the CA declares that "Google Maps" is a Reliable Data Source (it isn't, but again, underspecified), and verifies that there's an entry under 3.2.2.1(2) - despite the fact I just added the entry<o:p></o:p></p></div><div><p class=MsoNormal>- They then need to verify whether or not I'm authorized to speak for your company.<o:p></o:p></p></div><div><p class=MsoNormal> - The information used in 3.2.2.1 doesn't have to be used ("the CA MAY use ..."), but remember, I may have made it up under 3.2.2.1<o:p></o:p></p></div><div><p class=MsoNormal> - The CA can directly call me, Ryan Sleevi, asking if I'm authorized ("the CA MAY establish the authenticity of the certificate request directly with the Applicant Representative")<o:p></o:p></p></div><div><p class=MsoNormal> - The requirement to use an RMOC simply means that Foo CA could decide to call up Jeremy, since Jeremy knows me, and say "Hey, does Ryan work for Adriano Santoni" - that's all that's required.<o:p></o:p></p></div><div><p class=MsoNormal>- Finally, the CA contacts the registrar, and says "Hey, does Adriano Santoni's Lightly Validated Certificates own <a href="http://example.com">example.com</a>" - and the registrar says sure<o:p></o:p></p></div><div><p class=MsoNormal> - Note: There's no consensus whether we're talking about the same organization - perhaps I created a version incorporated in the US, but you're incorporated in Italy<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>These are just a few of the legal-but-bad things you can do. I'm sure we'll see the normal rush from some CAs saying "Yes, but we'd never do that" - while ignoring the fact that some could, as it's valid under the language, and we consistently see "That which is valid (or subject to misinterpretation) is possible to use"<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Could you provide an example of how you believe 3.2.2.4.1 "should" work and offer the same level of assurance as the other methods, without normatively prescribing the data sources used? From conversations with both current and past employees of CAs, I am adamantly convinced that there is not a consistent standard of reliableness being applies. Google Maps being used as a Reliable Data Source is not a hypothetical, despite it allowing community edits.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div></div><div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>On Thu, Dec 21, 2017 at 4:00 AM, Adriano Santoni via Public <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>> wrote:<o:p></o:p></p><blockquote style='border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in'><div><p>Jeremy, I am not sure I fully understand the problems you describe. <o:p></o:p></p><p>Would it be possible for you to provide some concrete example related to method #1, with some details, without of course mentioning specific certificates and/or organizations?<o:p></o:p></p><div><div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p><div><p class=MsoNormal>Il 19/12/2017 22:30, Jeremy Rowley via Public ha scritto:<o:p></o:p></p></div></div></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div><div><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Hi all, <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>When reviewing the Symantec validation methods and the customers using each method, I found an alarming number of customers verified under 3.2.2.4.1 (Verification of a Domain Contact) or 3.2.2.4.5 (Domain Authorization Document) where the domain is not technically associated with the entity. These two methods need improvement or removal as the way they are currently lacks sufficient controls to associate the domain verification with the actual certificate approver. I’ve had too many calls with customers explaining re-verification where the domain holder didn’t understand that a cert issued for the domain. Although the organization verification was successfully complete, the only tie between the domain and organization is a call to the organization that happened within the last years to approve the account for issuance. I wanted to bring it up here because I’ve always thought these methods were less desirable than others. I think other large CAs use this method quite a bit so I’m hoping to get clarity on why these methods are permitted when the domain verification seems more “hand-wavy” than other methods. <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Method 3.2.2.4.1 permits a CA to issue a certificate if the certificate is an EV or OV cert. With EV certificates, there is a call to a verified telephone number that confirms the requester’s affiliation with the organization. I can see this method working for EV. For OV certificates, there is a reliable method of communication that confirms the account holder as affiliated with the organization. Unlike EV, for OV certs there is no tie between the requester and their authority to request a certificate. Once the organization is verified, the BRs permit auto-issuance for any domain that reflects an affiliation with the verified entity for up to 825 days. There’s no notice to the domain contact that the certificate was requested or approved. Perhaps this is sufficient as the account has been affiliated with the organization through the reliable method of communication and because CT will soon become mandatory. <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Method 3.2.2.4.5 permits a CA to issue a certificate using a legal opinion letter for the domain. Unfortunately the BRs lack clear requirements about how the legal opinion letter is verified. If I want a cert for Google.com and the CA is following the bare minimum, all I need to do is copy their letterhead and sign the document. Magically, a certificate can issue. This method lacks a lot of controls of method 1 because there is no requirement around verification of the company. I can list as many domains in the letter as I’d like provided the entity listed in the corresponding WHOIS’s letterhead is used.<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>I’m looking to remove/fix both of these methods as both these methods lack the necessary controls to ensure that the verification ties to the domain holder. These methods probably should have been removed back when we passed 169/182. Would anyone being willing to endorse a ballot killing these or making some necessary improvements? <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'>Jeremy<o:p></o:p></p><p class=MsoNormal style='mso-margin-top-alt:auto;mso-margin-bottom-alt:auto'> <o:p></o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'><o:p> </o:p></p></div></div><pre>_______________________________________________<o:p></o:p></pre><pre>Public mailing list<o:p></o:p></pre><pre><a href="mailto:Public@cabforum.org" target="_blank">Public@cabforum.org</a><o:p></o:p></pre><pre><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></pre></blockquote><p class=MsoNormal><o:p> </o:p></p></div><p class=MsoNormal style='margin-bottom:12.0pt'><br>_______________________________________________<br>Public mailing list<br><a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br><a href="https://cabforum.org/mailman/listinfo/public" target="_blank">https://cabforum.org/mailman/listinfo/public</a><o:p></o:p></p></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></div></body></html>