<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=utf-8"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.apple-converted-space
{mso-style-name:apple-converted-space;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:281352150;
mso-list-type:hybrid;
mso-list-template-ids:-1723193130 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
{mso-level-text:"%1\)";
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level2
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level3
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level4
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level5
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level6
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l0:level7
{mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level8
{mso-level-number-format:alpha-lower;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;}
@list l0:level9
{mso-level-number-format:roman-lower;
mso-level-tab-stop:none;
mso-level-number-position:right;
text-indent:-9.0pt;}
@list l1
{mso-list-id:1568224403;
mso-list-template-ids:1743840018;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>The ambiguity is exactly why we need to remove method 1. I’ve seen all of the following:<o:p></o:p></p><ol style='margin-top:0in' start=1 type=1><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo2'>Approval based on a name match<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo2'>Approval based on an email match (same email as requester or the email is a corporate email) – note that this is a Domain Contact match<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo2'>Approval based on address and name match<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo2'>Approval based on a letter from the registrar<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo2'>Approval based on a call to the registrar<o:p></o:p></li><li class=MsoListParagraph style='margin-left:0in;mso-list:l0 level1 lfo2'>Approval based on a validation email to the registrar<o:p></o:p></li></ol><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>All of these are equally permitted by the language, IMO, because “by validating the Applicant has the same name as the Domain Contact directly with the Domain Name Registrar” can mean a LOT of things.<o:p></o:p></p><p class=MsoNormal><a name="_MailEndCompose"><o:p> </o:p></a></p><span style='mso-bookmark:_MailEndCompose'></span><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> geoffk@apple.com [mailto:geoffk@apple.com] <br><b>Sent:</b> Wednesday, January 3, 2018 2:54 PM<br><b>To:</b> Jeremy Rowley <jeremy.rowley@digicert.com><br><b>Cc:</b> CA/Browser Forum Public Discussion List <public@cabforum.org>; Ryan Sleevi <sleevi@google.com>; Adriano Santoni <adriano.santoni@staff.aruba.it><br><b>Subject:</b> Re: [cabfpub] Verification of Domain Contact and Domain Authorization Document<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>It looks like we’re going to be removing 3.2.2.4.1, so this will be moot, but just to explain the interpretation, 3.2.2.4.1 says that what you are doing (this sentence is the entire description of the method, the rest of the section just limits its application) is "Confirming the Applicant's control over the FQDN by validating the Applicant is the Domain Contact directly with the Domain Name Registrar.”<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>This is not a name match. If the BRs wanted to say “by validating the Applicant has the same name as the Domain Contact”, they would say so. This is a one-and-the-same match, it uses the word “is”. In the example below, the CA must ensure that “Google Inc., the Utah corporation” is the same one as shown in the WHOIS information, and all the WHOIS information is relevant in confirming this.<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><p class=MsoNormal>Another important clarification is that if you use 3.2.2.1, it doesn’t just verify “the name of the applicant”; it says that "the CA SHALL verify the identity and address of the organization”, not just the name. (Um… actually, if you read it closely, you might not verify the name at all, if you identify the organization in another way, maybe with some kind of ID number. That’s probably a bug.)<o:p></o:p></p></div><div><p class=MsoNormal><o:p> </o:p></p></div><div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><p class=MsoNormal>On 2 Jan 2018, at 8:47 pm, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com">jeremy.rowley@digicert.com</a>> wrote:<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div><p class=MsoNormal>I disagree. The requirements do not specify that. All that is required is the name of the applicant was verified under 3.2.2.1 and that the register specify the domain contact is the applicant. If Google, Inc. is specified as the domain contact, no address matching is required.<o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><div><p class=MsoNormal><b>From:</b><span class=apple-converted-space> </span><a href="mailto:geoffk@apple.com">geoffk@apple.com</a> [<a href="mailto:geoffk@apple.com">mailto:geoffk@apple.com</a>]<span class=apple-converted-space> </span><br><b>Sent:</b><span class=apple-converted-space> </span>Tuesday, January 2, 2018 4:34 PM<br><b>To:</b><span class=apple-converted-space> </span>Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com">jeremy.rowley@digicert.com</a>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org">public@cabforum.org</a>><br><b>Cc:</b><span class=apple-converted-space> </span>Ryan Sleevi <<a href="mailto:sleevi@google.com">sleevi@google.com</a>>; Adriano Santoni <<a href="mailto:adriano.santoni@staff.aruba.it">adriano.santoni@staff.aruba.it</a>><br><b>Subject:</b><span class=apple-converted-space> </span>Re: [cabfpub] Verification of Domain Contact and Domain Authorization Document<o:p></o:p></p></div></div></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><div><p class=MsoNormal><br><br><br><o:p></o:p></p></div><blockquote style='margin-top:5.0pt;margin-bottom:5.0pt'><div><div><p class=MsoNormal>On Dec 22, 2017, at 12:09 PM, Jeremy Rowley via Public <<a href="mailto:public@cabforum.org"><span style='color:purple'>public@cabforum.org</span></a>> wrote:<o:p></o:p></p></div></div><div><p class=MsoNormal> <o:p></o:p></p></div><div><div><div><p class=MsoNormal>The attack vector is easier than that.<span class=apple-converted-space> </span><o:p></o:p></p></div></div><ol style='margin-top:0in' start=1 type=1><li class=MsoNormal style='mso-list:l1 level1 lfo1'>I use very stringent processes to verify that Google, Inc. is a legit company in Utah.<o:p></o:p></li><li class=MsoNormal style='mso-list:l1 level1 lfo1'>I verify that Jeremy did indeed incorporate Google, Inc.<span class=apple-converted-space> </span><o:p></o:p></li><li class=MsoNormal style='mso-list:l1 level1 lfo1'>I call Jeremy at the phone listed for Google, Inc., the Utah corporation<o:p></o:p></li><li class=MsoNormal style='mso-list:l1 level1 lfo1'>The domain information shows Google, Inc. as owning<span class=apple-converted-space> </span><a href="http://google.com/"><span style='color:purple'>google.com</span></a><o:p></o:p></li><li class=MsoNormal style='mso-list:l1 level1 lfo1'>Certificate issues.<o:p></o:p></li></ol><div><div><p class=MsoNormal> <o:p></o:p></p></div></div><div><div><p class=MsoNormal>Obviously this would be caught in every CA’s high risk checks, but the point remains valid. Regardless of the expertise and thoroughness of the org check, the specs lack any time between the verified org and the actual domain because orgs are not unique on a global basis.<o:p></o:p></p></div></div><div><div><p class=MsoNormal> <o:p></o:p></p></div></div></div></blockquote><div><p class=MsoNormal> <o:p></o:p></p></div></div><div><div><p class=MsoNormal>For item 4, you have to verify that “the Applicant is the Domain Contact”. Obviously it’s insufficient to just compare names—you must verify every element of the WHOIS contact matches the Applicant, that’s typically name, postal address, phone number, and e-mail.<o:p></o:p></p></div></div></div></blockquote></div><p class=MsoNormal><o:p> </o:p></p></div></body></html>