<div dir="ltr">Adding to this, in most cases Whois is redacted these days anyways (and RDAP in the ICANN recommended implementation is entirely useless for email validation as it requires all email addresses to be replaced by a contact form going through the registrar).<div><br></div><div>The only reliable use case I could think of is where the registrar is also the SSL CA and thus has unredacted access to its registration data. But this use case is already allowed separately (3.2.2.4.12 Validating Applicant as a Domain Contact), so it would still be allowed after removing Whois as an allowed validation method.</div><div><br></div><div>It would be very useful to have numbers on how often this method is actually used, maybe CAs could share some insight here?</div><div><br></div><div>I do agree that Whois based validation should be retired, but the timeline seems too quick.</div><div><br></div><div>Maria Merkel</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Sep 18, 2024 at 11:14 AM Q Misell via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><br>Consulting with the IANA registrar falls apart when a reseller is involved. Sometimes the correct contact data is held by a reseller not the registrar of record.<div><br></div><div>I don't think we should allow validation based on <a href="https://e.as207960.net/w4bdyj/U0u4dSeajXbodURp" target="_blank">Registration Directory Services</a> knowing how unreliable they can be.<br><div><div dir="ltr" class="gmail_signature">
<hr style="height:1px;background-color:rgb(203,213,224);margin-top:1rem;margin-bottom:1rem;border:0px">
<p style="font-size:12px;color:rgb(108,117,125)">
Any statements contained in this email are personal to the author and are not necessarily the statements of the company unless specifically stated.
AS207960 Cyfyngedig, having a registered office at 13 Pen-y-lan Terrace, Caerdydd, Cymru, CF23 9EU, trading as Glauca Digital, is a company registered in Wales under № <a href="https://e.as207960.net/w4bdyj/9RSVdvm0MrsRNsbs" target="_blank">12417574</a>, LEI 875500FXNCJPAPF3PD10.
ICO register №: <a href="https://e.as207960.net/w4bdyj/KbjUXXJAKmBFs6zI" target="_blank">ZA782876</a>.
UK VAT №: GB378323867.
EU VAT №: EU372013983.
Turkish VAT №: 0861333524.
South Korean VAT №: 522-80-03080.
AS207960 Ewrop OÜ, having a registered office at Lääne-Viru maakond, Tapa vald, Porkuni küla, Lossi tn 1, 46001, trading as Glauca Digital, is a company registered in Estonia under № 16755226. Estonian VAT №: EE102625532.
Glauca Digital and the Glauca logo are registered trademarks in the UK, under № UK00003718474 and № UK00003718468, respectively.
</p></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, 18 Sept 2024 at 10:59, Amir Omidi via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="auto">I do not agree. What’s the point of keeping this bespoke method available? These options create complexity and complexity creates security vulnerabilities. In what situation would this method be useful where DNS currently can’t solve that need?</div><div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Sep 18, 2024 at 04:56 Adriano Santoni via Servercert-wg <<a href="mailto:servercert-wg@cabforum.org" target="_blank">servercert-wg@cabforum.org</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>
<div>
<div><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)">I agree if by
"WHOIS-related" methods we mean any method based on the WHOIS
protocol, either directly or via protocol gateways (e.g.
web-based interfaces to WHOIS records). And I support the WHOIS
deprecation initiative in this sense, since it has been shown
that it may be unreliable.</font></div>
<div><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)"><br>
</font></div>
<div><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)">However, where the
domain contacts information is obtained, e.g. via the web, from
an IANA-accredited domain registrar and is *not* based on WHIOS,
then I think it can be used. </font></div>
<div><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)">I assume everyone
agrees as long as no one raises a hand to object.</font></div></div><div><div><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)"><br>
</font></div>
<div><br>
</div>
<div>Adriano</div>
<div><br>
</div>
<div>Il 17/09/2024 18:04, Pedro FUENTES ha
scritto:<br>
</div>
<blockquote type="cite">
<div dir="ltr">Could it be that we all agree that WHOIS-related
method are so tricky that it deserves to be ditched and the only
thing to requires consensus is the deadline to apply?</div>
<div dir="ltr"><br>
</div>
<div dir="ltr">On my particular side, I personally consider that
1/1/2025 is a reasonable date. </div>
<div dir="ltr"><br>
<blockquote type="cite">Le 17 sept. 2024 à 17:59, Adriano
Santoni via Servercert-wg <a href="mailto:servercert-wg@cabforum.org" target="_blank"><servercert-wg@cabforum.org></a> a
écrit :<br>
<br>
</blockquote>
</div>
<blockquote type="cite">
<div dir="ltr">
<p><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)">Andrew,<br>
</font></p>
<p><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)">I was not referring to any WHOIS
server, but rather to the information about domain
"owners" that a registrar is supposed to collect and keep.</font></p>
<p><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)">So you believe that if a CA does the
following, the domain contact email they can (sometimes)
get is <i style="font-family:Calibri">unreliable</i>?<br>
</font></p>
<p><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)">1) Consult the list of accredited
domain registrars on the IANA website (<a href="https://e.as207960.net/w4bdyj/H1JzZCLPVSEY13XJ" style="font-family:Calibri" target="_blank">https://www.icann.org/en/accredited-registrars</a>),
thus finding confirmation of one particular registrar's
website the CA was looking for.<br>
2) Access the website found in point 1 above and query the
information available on a certain domain.<br>
3) At this point, sometimes (rarely) obtain, among other
information, also the email address of a domain contact.<br>
</font></p>
<p><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)">Note that here I'm not talking about
the WHOIS protocol nor WHOIS servers, but about the
information that the domain registrar has the duty to
collect and store (not necessarily publish) about the
subject who registered a domain.<br>
</font></p>
<p><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)">Regards,</font></p>
<p><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)">Adriano</font></p>
<p><font face="Calibri" style="font-family:Calibri;color:rgb(0,0,0)"><br>
</font></p>
<div>Il 17/09/2024 17:13, Andrew Ayer
ha scritto:<br>
</div>
<blockquote type="cite">
<pre style="font-family:monospace">[NOTICE: Pay attention - external email - Sender is <a href="mailto:agwa@andrewayer.name" style="font-family:monospace" target="_blank">agwa@andrewayer.name</a> ]
On Tue, 17 Sep 2024 07:21:28 +0000
Adriano Santoni via Servercert-wg <a href="mailto:servercert-wg@cabforum.org" style="font-family:monospace" target="_blank"><servercert-wg@cabforum.org></a> wrote:
</pre>
<blockquote type="cite">
<pre style="font-family:monospace">I believe that the /interactive
/query of the domain registrar, directly on its website, can be
considered reliable to the extent that the CA is confident that it is in
fact consulting the "right" website.
</pre>
</blockquote>
<pre style="font-family:monospace">CAs were not consulting the right WHOIS server, despite a database of
correct WHOIS servers existing (at least for gTLDs). How would the problem
be better when it comes to finding the "right" website?
The gTLD registry agreement requires gTLD operators to update the IANA
Rootzone Database when their WHOIS server changes; I don't see a
similar requirement for keeping a database of website URLs up-to-date.
Regards,
Andrew
</pre>
</blockquote>
<span>_______________________________________________</span><br>
<span>Servercert-wg mailing list</span><br>
<span><a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a></span><br>
<span><a href="https://e.as207960.net/w4bdyj/nFNVYlUfxuxcg038" target="_blank">https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.cabforum.org_mailman_listinfo_servercert-2Dwg&d=DwICAg&c=euGZstcaTDllvimEN8b7jXrwqOf-v5A_CdpgnVfiiMM&r=-bX5hBm1IdRDykQ-dBR8tsFRCM4v1VXUyG7RZa2WqPY&m=IqgVx_nvAxgc9vUVg8d2gCn7R7eMqKPCSgoIW6If9F-DHYck2BXkEdTactbQnmGx&s=TSpgJKJi2JL8yKR40EYmCep1QcQe0Ueo8VaHzA2ijT0&e=</a></span><br>
</div>
</blockquote>
</blockquote>
</div>
_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://e.as207960.net/w4bdyj/3ZZB5DEI1xwMn0DE" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><br>
</blockquote></div></div>
_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://e.as207960.net/w4bdyj/JXP5t0JjVxRBmGcU" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><br>
</blockquote></div>
<p style="display:none;margin:0px;padding:0px;line-height:0"><img src="https://e.as207960.net/img/w4bdyj/oK5m7hW6mBxJ0wLN" alt=""></p>_______________________________________________<br>
Servercert-wg mailing list<br>
<a href="mailto:Servercert-wg@cabforum.org" target="_blank">Servercert-wg@cabforum.org</a><br>
<a href="https://lists.cabforum.org/mailman/listinfo/servercert-wg" rel="noreferrer" target="_blank">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a><br>
</blockquote></div>