<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div><blockquote type="cite" class=""><div dir="ltr" class=""><br class=""><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Sep 9, 2020 at 12:08 PM Dimitris Zacharopoulos (HARICA) <<a href="mailto:dzacharo@harica.gr" class="">dzacharo@harica.gr</a>> wrote:<br class=""></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div class=""><br class="">
It's also unambiguously clear that parts in a TLS Certificates that
are not related to a Domain Name, are not part of the "processing
model used in TLS to validate a domain name". You have been
advocating that, for any Identity Information included in TLS
Certificates, yet there are cases where this information is used.</div></blockquote><div class=""><br class=""></div><div class="">Not by browsers. Which is precisely why it doesn't belong in the TLS certificates used, by browsers, to connect to a server.</div></div></div></blockquote><br class=""></div><div style="font-size: 16px;">[PW] I’m sorry if I’m asking a specific question that has been answered already. I’m really hoping to learn more about this particular issue. Even if I get a response that’s not to my understanding or liking, I’ll simply digest it, and leave it at that :)</div><div style="font-size: 16px;"><br class=""></div><div style="font-size: 16px;">Referring only to fields that browsers don’t use - are there any fields that have been empty, or populated incorrectly in the past, that resulted in a security problem for one or more organization? </div><div style="font-size: 16px;"><br class=""></div><div style="font-size: 16px;">If yes, is it possible to get a link to a news website or company blog where the security incident was announced? I’d also love to learn how those fields caused a problem if they’re not used by browsers.</div><div style="font-size: 16px;"><br class=""></div><div style="font-size: 16px;">If a browser doesn’t need specific fields, can’t they just ignore them and allow other certificate consumers to use them? </div><div style="font-size: 16px;"><br class=""></div><div style="font-size: 16px;">For example, a mobile carrier might want to consume certificates that contain one or two specific fields that browser vendors don’t use/trust, while ignoring the encryption aspect of the cert. I know of a few new implementations for identity information that are going to use an API and metadata, but from an industry perspective, I’d like to see existing certificates consumed in ways that add more internet safety further down the tech stack - before the browser even sees it. </div><div style="font-size: 16px;"><br class=""></div><div style="font-size: 16px;">If we were all discussing this for the first time, I would favor non-TLS for identity information, but the certificates are out there being used already. Alternative solutions do exist, but there’s room for multiple approaches. </div><div style="font-size: 16px;"><br class=""></div><div style="font-size: 16px;">Thanks,</div><div style="font-size: 16px;">Paul</div><br class=""></body></html>