<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<p style="color:rgb(32, 31, 30);background-color:rgb(255, 255, 255);font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt;color:black">Section 7.1.5 of the BR's state:</span></p>
<blockquote style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:15px;background-color:rgb(255, 255, 255)">
<div style="margin:0px">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;font-family:Consolas;color:black">If the Subordinate CA is not allowed to issue certificates with dNSNames, then the Subordinate CA Certificate MUST
include a zero-length dNSName in excludedSubtrees. Otherwise, the Subordinate CA Certificate MUST include at least one dNSName in permittedSubtrees.</span><span style="color: black; font-size: 12pt;"> </span></p>
</div>
</blockquote>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;color:black">Which permits an empty value in the <span style="margin:0px;background-color:white">excluded subtrees of the name constraints.</span></span></p>
</div>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;color:black"> </span></p>
</div>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px 0px 12pt"><span style="margin:0px;font-size:12pt;color:black;background-color:white">Reading the RFC 5180 this is not clearly stated but it might be interpreted that way as adding something
to nothing always results in a match.</span></p>
<blockquote>
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;font-family:Consolas;color:black;background-color:white">DNS name restrictions are expressed as host.example.com. Any DNS</span><span style="margin:0px;font-size:12pt;color:black;background-color:white"></span></p>
<div style="margin:0px">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;font-family:Consolas;color:black;background-color:white"> name that can be constructed by simply adding zero or more labels to</span><span style="margin:0px;font-size:12pt;color:black;background-color:white"></span></p>
</div>
<div style="margin:0px">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;font-family:Consolas;color:black;background-color:white"> the left-hand side of the name satisfies the name constraint.</span></p>
</div>
</blockquote>
<div style="margin:0px">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px 0px 12pt"><span style="margin:0px;font-size:12pt;color:black;background-color:white">RFC4985 contains a similar language:</span></p>
</div>
</div>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<blockquote>
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;font-family:Consolas;color:black">DNS name restrictions are expressed as host.example.com. Any DNS</span><span style="margin:0px;font-size:12pt;color:black"></span></p>
<div style="margin:0px">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;font-family:Consolas;color:black"> name that can be constructed by simply adding subdomains to the</span><span style="margin:0px;font-size:12pt;color:black"></span></p>
</div>
<div style="margin:0px">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;font-family:Consolas;color:black"> left-hand side of the name satisfies the DNS name part of the name</span><span style="margin:0px;font-size:12pt;color:black"></span></p>
</div>
<div style="margin:0px">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;font-family:Consolas;color:black"> constraint. For example,<span> </span><a href="http://www.host.example.com/" target="_blank" rel="noopener noreferrer" data-auth="NotApplicable" data-linkindex="0" style="margin:0px">www.host.example.com</a><span> </span>would
satisfy the</span><span style="margin:0px;font-size:12pt;color:black"></span></p>
</div>
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;font-family:Consolas;color:black"> constraint (host.example.com) but 1host.example.com would not.</span></p>
</blockquote>
</div>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;color:black">Does this mean that the SRVNames can/should be blocked by adding an empty value to the <span style="margin:0px;background-color:white">excluded
subtrees of the name constraints?</span></span></p>
</div>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;color:black"> </span></p>
</div>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;color:black;background-color:white">The reason for asking is because implementations seem to be slightly different per type of name. </span><span style="margin:0px;font-size:12pt;color:black">An
empty DNSName in the excluded subtree is correctly prohibited by OpenSSL and Windows as described in baseline requirements. An URI with an empty value is prohibited in Windows but ignored by OpenSSL, while the RFC describes the logic like the DNSName only
with more words and that it MUST contain an FQDN for some reason.</span></p>
</div>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;color:black"> </span></p>
</div>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;color:black">Summary of my understanding:</span></p>
</div>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;color:black"> </span></p>
</div>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;color:black">Restricted using an empty value <span style="margin:0px;background-color:white">in the excluded subtrees:</span></span></p>
</div>
<div style="margin:0px;font-size:15px;font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;color:rgb(32, 31, 30);background-color:rgb(255, 255, 255)">
<ul type="disc" style="margin-bottom:0px">
<li style="color:black;font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt">DNSName</span></li><li style="color:black;font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt">SRVName</span></li></ul>
<div style="margin:0px">
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;color:black"><br>
</span></p>
<p style="font-size:11pt;font-family:Calibri, sans-serif;margin:0px"><span style="margin:0px;font-size:12pt;color:black">GeneralName types that may not be r<span style="margin:0px;background-color:white">estricted using an empty value in the excluded subtrees:</span></span></p>
</div>
<ul type="disc" style="margin-bottom:0px">
<li style="color:black;font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt;background-color:white">URIs: Must be restricted using a value in the permitted subtrees</span><span style="margin:0px;font-size:12pt"></span></li><li style="color:black;font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt;background-color:white">RFC822Name: Must be restricted using a value in the permitted subtrees</span><span style="margin:0px;font-size:12pt"></span></li><li style="color:black;font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt">SmtpUTF8Mailbox: Is restricted using rfc822Name and must not be included in the name constraints</span></li></ul>
</div>
<p style="color:rgb(32, 31, 30);background-color:rgb(255, 255, 255);font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt;color:black"><br>
</span></p>
<p style="color:rgb(32, 31, 30);background-color:rgb(255, 255, 255);font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt;color:black">Is the above correct?</span></p>
<p style="color:rgb(32, 31, 30);background-color:rgb(255, 255, 255);font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt;color:black"><br>
</span></p>
<p style="color:rgb(32, 31, 30);background-color:rgb(255, 255, 255);font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt;color:black">Does this mean that there is no way to exclude all URIs, <span style="text-align:left;background-color:rgb(255, 255, 255);display:inline !important">RFC822Name or Othernames without adding them with a value
you might also not want to permit in the permitted subtree?</span></span></p>
<p style="color:rgb(32, 31, 30);background-color:rgb(255, 255, 255);font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt;color:black"><span style="text-align:left;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></span></p>
<p style="color:rgb(32, 31, 30);background-color:rgb(255, 255, 255);font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt;color:black"><span style="text-align:left;background-color:rgb(255, 255, 255);display:inline !important">Thanks,</span></span></p>
<p style="color:rgb(32, 31, 30);background-color:rgb(255, 255, 255);font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt;color:black"><span style="text-align:left;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></span></p>
<p style="color:rgb(32, 31, 30);background-color:rgb(255, 255, 255);font-size:11pt;font-family:Calibri, sans-serif;margin:0px">
<span style="margin:0px;font-size:12pt;color:black"><span style="text-align:left;background-color:rgb(255, 255, 255);display:inline !important">Paul</span></span></p>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Validation <validation-bounces@cabforum.org> on behalf of Ryan Sleevi via Validation <validation@cabforum.org><br>
<b>Sent:</b> Friday, April 23, 2021 00:18<br>
<b>To:</b> CA/Browser Forum Validation WG List <validation@cabforum.org><br>
<b>Subject:</b> [EXTERNAL] [cabf_validation] SRVNames in subjectAltNames and nameConstraints</font>
<div> </div>
</div>
<div>WARNING: This email originated outside of Entrust.<br>
DO NOT CLICK links or attachments unless you trust the sender and know the content is safe.<br>
<hr>
<div dir="ltr">As a follow-up to our call today, I filed <a href="https://urldefense.com/v3/__https://github.com/cabforum/servercert/issues/268__;!!FJ-Y8qCqXTj2!LdK6Q4WRP9QWdfGzePGS20CdFzVRO-_3ur9uhjLasQTscHbyRv8gy7VOC5IvTfH1XvDMxpbShA$">https://github.com/cabforum/servercert/issues/268</a>
to capture the discussion we had around SRVNames, so that we can explore steps going forward.
<div><br>
</div>
<div>While it is not a priority of Google to add support for SRVNames, relative to the other important work still to be done in the Forum, we're broadly supportive of the goal.</div>
<div><br>
</div>
<div>Our proposed sequencing is this:</div>
<div>
<ol>
<li>A transition path so that existing technically constrained sub-CAs, which are not constrained by SRVNames, are phased out (e.g. revoked and replaced in time)</li><li>Support for SRVNames added to browser clients. This cannot happen before 1, due to the security risk otherwise.</li><li>Support for CAs issuing SRVNames</li><ul>
<li>At a minimum, CAs MUST validate the Domain Portion in a manner consistent with validating a dNSName</li><li>It's unclear what policies should be developed for service names, particularly for those using the "host-based" demonstrations of control (e.g. 3.2.2.4.17/.18) - ALPN and .well-known. One path might be mapping the port used for the validation to the IANA
well-known port registry (e.g. 80 or 443 becomes "http" SRVName, 465/587 becomes "smtp", etc)</li></ul>
</ol>
<div>Since there was a desire to keep discussing, I said I'd file a GitHub issue and discuss on list.</div>
</div>
</div>
</div>
</body>
</html>