<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">It looks like we’re going to be removing 3.2.2.4.1, so this will be moot, but just to explain the interpretation, 3.2.2.4.1 says that what you are doing (this sentence is the entire description of the method, the rest of the section just limits its application) is "Confirming the Applicant's control over the FQDN by validating the Applicant is the Domain Contact directly with the Domain Name Registrar.”</div><div class=""><br class=""></div><div class="">This is not a name match. If the BRs wanted to say “by validating the Applicant has the same name as the Domain Contact”, they would say so. This is a one-and-the-same match, it uses the word “is”. In the example below, the CA must ensure that “Google Inc., the Utah corporation” is the same one as shown in the WHOIS information, and all the WHOIS information is relevant in confirming this.</div><div class=""><br class=""></div><div class="">Another important clarification is that if you use 3.2.2.1, it doesn’t just verify “the name of the applicant”; it says that "the CA SHALL verify the identity and address of the organization”, not just the name. (Um… actually, if you read it closely, you might not verify the name at all, if you identify the organization in another way, maybe with some kind of ID number. That’s probably a bug.)</div><div class=""><br class=""></div><div><blockquote type="cite" class=""><div class="">On 2 Jan 2018, at 8:47 pm, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" class="">jeremy.rowley@digicert.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I disagree. The requirements do not specify that. All that is required is the name of the applicant was verified under 3.2.2.1 and that the register specify the domain contact is the applicant. If Google, Inc. is specified as the domain contact, no address matching is required.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><a name="_MailEndCompose" class=""><o:p class=""> </o:p></a></div><span class=""></span><div class=""><div style="border-style: solid none none; border-top-width: 1pt; border-top-color: rgb(225, 225, 225); padding: 3pt 0in 0in;" class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class="">From:</b><span class="Apple-converted-space"> </span><a href="mailto:geoffk@apple.com" class="">geoffk@apple.com</a> [<a href="mailto:geoffk@apple.com" class="">mailto:geoffk@apple.com</a>]<span class="Apple-converted-space"> </span><br class=""><b class="">Sent:</b><span class="Apple-converted-space"> </span>Tuesday, January 2, 2018 4:34 PM<br class=""><b class="">To:</b><span class="Apple-converted-space"> </span>Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" class="">jeremy.rowley@digicert.com</a>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>><br class=""><b class="">Cc:</b><span class="Apple-converted-space"> </span>Ryan Sleevi <<a href="mailto:sleevi@google.com" class="">sleevi@google.com</a>>; Adriano Santoni <<a href="mailto:adriano.santoni@staff.aruba.it" class="">adriano.santoni@staff.aruba.it</a>><br class=""><b class="">Subject:</b><span class="Apple-converted-space"> </span>Re: [cabfpub] Verification of Domain Contact and Domain Authorization Document<o:p class=""></o:p></div></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class=""><br class=""><o:p class=""></o:p></div><blockquote style="margin-top: 5pt; margin-bottom: 5pt;" class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">On Dec 22, 2017, at 12:09 PM, Jeremy Rowley via Public <<a href="mailto:public@cabforum.org" style="color: purple; text-decoration: underline;" class="">public@cabforum.org</a>> wrote:<o:p class=""></o:p></div></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div class=""><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">The attack vector is easier than that.<span class="apple-converted-space"> </span><o:p class=""></o:p></div></div><ol start="1" type="1" style="margin-bottom: 0in; margin-top: 0in;" class=""><li class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">I use very stringent processes to verify that Google, Inc. is a legit company in Utah.<o:p class=""></o:p></li><li class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">I verify that Jeremy did indeed incorporate Google, Inc.<span class="apple-converted-space"> </span><o:p class=""></o:p></li><li class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">I call Jeremy at the phone listed for Google, Inc., the Utah corporation<o:p class=""></o:p></li><li class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">The domain information shows Google, Inc. as owning<span class="apple-converted-space"> </span><a href="http://google.com/" style="color: purple; text-decoration: underline;" class=""><span style="color: purple;" class="">google.com</span></a><o:p class=""></o:p></li><li class="MsoNormal" style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;">Certificate issues.<o:p class=""></o:p></li></ol><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Obviously this would be caught in every CA’s high risk checks, but the point remains valid. Regardless of the expertise and thoroughness of the org check, the specs lack any time between the verified org and the actual domain because orgs are not unique on a global basis.<o:p class=""></o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""> <o:p class=""></o:p></div></div></div></blockquote><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div></div><div class=""><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">For item 4, you have to verify that “the Applicant is the Domain Contact”. Obviously it’s insufficient to just compare names—you must verify every element of the WHOIS contact matches the Applicant, that’s typically name, postal address, phone number, and e-mail.</div></div></div></div></blockquote></div><br class=""></body></html>