<div dir="ltr">This does not resolve the issues mentioned.</div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Jan 4, 2018 at 7:47 AM, Mads Egil Henriksveen via Public <span dir="ltr"><<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div lang="NO-BOK" link="blue" vlink="purple">
<div class="m_9063602371728769345WordSection1">
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d">Removing method 1 is not the only way to solve this ambiguity, it could also be solved by changing the language of 3.2.2.4.1 into something like this (changes are redlined
in attached document):<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><b><span lang="EN-US" style="font-size:10.0pt;font-family:"Cambria-Bold",serif">3.2.2.4.1 Validating the Applicant as a Domain Name Registrant<u></u><u></u></span></b></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:10.0pt;font-family:"Cambria",serif">Confirming the Applicant's control over the FQDN by validating the Applicant is the Domain Name Registrant. This method may only be used
if:<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:10.0pt;font-family:"Cambria",serif">1. The CA authenticates the Applicant's identity under BR Section 3.2.2.1 and the authority of the Applicant Representative under BR Section
3.2.5, OR<br>
The Applicant identity and address must match the Domain Name Registrant.<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:10.0pt;font-family:"Cambria",serif">2. The CA authenticates the Applicant's identity under EV Guidelines Section 11.2 and the agency of the Certificate Approver under EV Guidelines
Section 11.8; OR<br>
The Applicant must be the same legal entity as the Domain Name Registrant<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:10.0pt;font-family:"Cambria",serif">Note: Once the FQDN has been validated using this method, the CA MAY also issue Certificates for other<u></u><u></u></span></p>
<p class="MsoNormal" style="text-autospace:none"><span lang="EN-US" style="font-size:10.0pt;font-family:"Cambria",serif">FQDNs that end with all the labels of the validated FQDN. This method is suitable for validating Wildcard<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="font-size:10.0pt;font-family:"Cambria",serif">Domain Names.</span><span lang="EN-US" style="color:#1f497d"><u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d">This would also allow for using method 1 for the use cases I have identified.
<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d">Regards<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d">Mads<u></u><u></u></span></p>
<p class="MsoNormal"><span lang="EN-US" style="color:#1f497d"><u></u> <u></u></span></p>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Public [mailto:<a href="mailto:public-bounces@cabforum.org" target="_blank">public-bounces@<wbr>cabforum.org</a>]
<b>On Behalf Of </b>Jeremy Rowley via Public<br>
<b>Sent:</b> onsdag 3. januar 2018 23:25<br>
<b>To:</b> <a href="mailto:geoffk@apple.com" target="_blank">geoffk@apple.com</a><span class=""><br>
<b>Cc:</b> CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>
</span><span class=""><b>Subject:</b> Re: [cabfpub] Verification of Domain Contact and Domain Authorization Document<u></u><u></u></span></span></p>
</div>
</div>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><span lang="EN-US">The ambiguity is exactly why we need to remove method 1. I’ve seen all of the following:<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:36.0pt">
<u></u><span lang="EN-US"><span>1)<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN-US">Approval based on a name match<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:36.0pt">
<u></u><span lang="EN-US"><span>2)<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN-US">Approval based on an email match (same email as requester or the email is a corporate email) – note that this is a Domain Contact match<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:36.0pt">
<u></u><span lang="EN-US"><span>3)<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN-US">Approval based on address and name match<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:36.0pt">
<u></u><span lang="EN-US"><span>4)<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN-US">Approval based on a letter from the registrar<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:36.0pt">
<u></u><span lang="EN-US"><span>5)<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN-US">Approval based on a call to the registrar<u></u><u></u></span></p>
<p class="MsoNormal" style="margin-left:36.0pt">
<u></u><span lang="EN-US"><span>6)<span style="font:7.0pt "Times New Roman"">
</span></span></span><u></u><span lang="EN-US">Approval based on a validation email to the registrar<u></u><u></u></span></p><div><div class="h5">
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<p class="MsoNormal"><span lang="EN-US">All of these are equally permitted by the language, IMO, because “by validating the Applicant has the same name as the Domain Contact directly with the Domain Name Registrar” can mean a LOT of things.<u></u><u></u></span></p>
<p class="MsoNormal"><a name="m_9063602371728769345__MailEndCompose"><span lang="EN-US"><u></u> <u></u></span></a></p>
<span></span>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> <a href="mailto:geoffk@apple.com" target="_blank">
geoffk@apple.com</a> [<a href="mailto:geoffk@apple.com" target="_blank">mailto:geoffk@apple.com</a>]
<br>
<b>Sent:</b> Wednesday, January 3, 2018 2:54 PM<br>
<b>To:</b> Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>><br>
<b>Cc:</b> CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>>; Ryan Sleevi <<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>>; Adriano Santoni <<a href="mailto:adriano.santoni@staff.aruba.it" target="_blank">adriano.santoni@staff.aruba.<wbr>it</a>><br>
<b>Subject:</b> Re: [cabfpub] Verification of Domain Contact and Domain Authorization Document<u></u><u></u></span></p>
</div>
</div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<div>
<p class="MsoNormal"><span lang="EN-US">It looks like we’re going to be removing 3.2.2.4.1, so this will be moot, but just to explain the interpretation, 3.2.2.4.1 says that what you are doing (this sentence is the entire description of the method, the rest
of the section just limits its application) is "Confirming the Applicant's control over the FQDN by validating the Applicant is the Domain Contact directly with the Domain Name Registrar.”<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">This is not a name match. If the BRs wanted to say “by validating the Applicant has the same name as the Domain Contact”, they would say so. This is a one-and-the-same match, it uses the word “is”. In the example below,
the CA must ensure that “Google Inc., the Utah corporation” is the same one as shown in the WHOIS information, and all the WHOIS information is relevant in confirming this.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US">Another important clarification is that if you use 3.2.2.1, it doesn’t just verify “the name of the applicant”; it says that "the CA SHALL verify the identity and address of the organization”, not just the name. (Um…
actually, if you read it closely, you might not verify the name at all, if you identify the organization in another way, maybe with some kind of ID number. That’s probably a bug.)<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal"><span lang="EN-US">On 2 Jan 2018, at 8:47 pm, Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>> wrote:<u></u><u></u></span></p>
</div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">I disagree. The requirements do not specify that. All that is required is the name of the applicant was verified under 3.2.2.1 and that the register specify the domain contact is the applicant. If Google, Inc. is specified
as the domain contact, no address matching is required.<u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
<div>
<div style="border:none;border-top:solid #e1e1e1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<div>
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span class="m_9063602371728769345apple-converted-space"><span lang="EN-US"> </span></span><span lang="EN-US"><a href="mailto:geoffk@apple.com" target="_blank">geoffk@apple.com</a> [<a href="mailto:geoffk@apple.com" target="_blank">mailto:geoffk@apple.com</a>]<span class="m_9063602371728769345apple-converted-space"> </span><br>
<b>Sent:</b><span class="m_9063602371728769345apple-converted-space"> </span>Tuesday, January 2, 2018 4:34 PM<br>
<b>To:</b><span class="m_9063602371728769345apple-converted-space"> </span>Jeremy Rowley <<a href="mailto:jeremy.rowley@digicert.com" target="_blank">jeremy.rowley@digicert.com</a>>; CA/Browser Forum Public Discussion List <<a href="mailto:public@cabforum.org" target="_blank">public@cabforum.org</a>><br>
<b>Cc:</b><span class="m_9063602371728769345apple-converted-space"> </span>Ryan Sleevi <<a href="mailto:sleevi@google.com" target="_blank">sleevi@google.com</a>>; Adriano Santoni <<a href="mailto:adriano.santoni@staff.aruba.it" target="_blank">adriano.santoni@staff.aruba.<wbr>it</a>><br>
<b>Subject:</b><span class="m_9063602371728769345apple-converted-space"> </span>Re: [cabfpub] Verification of Domain Contact and Domain Authorization Document<u></u><u></u></span></p>
</div>
</div>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
<div>
<div>
<p class="MsoNormal" style="margin-bottom:12.0pt"><span lang="EN-US"><br>
<br>
<u></u><u></u></span></p>
</div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">On Dec 22, 2017, at 12:09 PM, Jeremy Rowley via Public <<a href="mailto:public@cabforum.org" target="_blank"><span style="color:purple">public@cabforum.org</span></a>> wrote:<u></u><u></u></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">The attack vector is easier than that.<span class="m_9063602371728769345apple-converted-space"> </span><u></u><u></u></span></p>
</div>
</div>
<ol style="margin-top:0cm" start="1" type="1">
<li class="MsoNormal"><span lang="EN-US">I use very stringent processes to verify that Google, Inc. is a legit company in Utah.<u></u><u></u></span></li><li class="MsoNormal"><span lang="EN-US">I verify that Jeremy did indeed incorporate Google, Inc.<span class="m_9063602371728769345apple-converted-space"> </span><u></u><u></u></span></li><li class="MsoNormal"><span lang="EN-US">I call Jeremy at the phone listed for Google, Inc., the Utah corporation<u></u><u></u></span></li><li class="MsoNormal"><span lang="EN-US">The domain information shows Google, Inc. as owning<span class="m_9063602371728769345apple-converted-space"> </span><a href="http://google.com/" target="_blank"><span style="color:purple">google.com</span></a><u></u><u></u></span></li><li class="MsoNormal"><span lang="EN-US">Certificate issues.<u></u><u></u></span></li></ol>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">Obviously this would be caught in every CA’s high risk checks, but the point remains valid. Regardless of the expertise and thoroughness of the org check, the specs lack any time between the verified org and the actual
domain because orgs are not unique on a global basis.<u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><span lang="EN-US"> <u></u><u></u></span></p>
</div>
</div>
<div>
<div>
<p class="MsoNormal"><span lang="EN-US">For item 4, you have to verify that “the Applicant is the Domain Contact”. Obviously it’s insufficient to just compare names—you must verify every element of the WHOIS contact matches the Applicant, that’s typically
name, postal address, phone number, and e-mail.<u></u><u></u></span></p>
</div>
</div>
</div>
</blockquote>
</div>
<p class="MsoNormal"><span lang="EN-US"><u></u> <u></u></span></p>
</div></div></div>
</div>
<br>______________________________<wbr>_________________<br>
Public mailing list<br>
<a href="mailto:Public@cabforum.org">Public@cabforum.org</a><br>
<a href="https://cabforum.org/mailman/listinfo/public" rel="noreferrer" target="_blank">https://cabforum.org/mailman/<wbr>listinfo/public</a><br>
<br></blockquote></div><br></div>