<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">I have wanted to fix this ever since we discovered it at a previous employer.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">-Tim<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div style="border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt">
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="mso-ligatures:none">From:</span></b><span style="mso-ligatures:none"> Validation <validation-bounces@cabforum.org>
<b>On Behalf Of </b>Corey Bonnell via Validation<br>
<b>Sent:</b> Tuesday, August 22, 2023 5:13 PM<br>
<b>To:</b> CABforum3 <validation@cabforum.org><br>
<b>Subject:</b> [cabf_validation] Publicly Trusted TLS certs with .arpa domains<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal">In reviewing the project board [1] for our group, I did some investigation into the “On Deck” item for validation requirements for .arpa domains [2]. It turns out that according to Censys, there are currently no unexpired and publicly trusted
certificates have been issued with a .arpa domain name [3].<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">When the topic of prohibiting such issuance was raised several years ago, there was some pushback as there were several thousand valid certificates with .arpa domain names at the time. However, given that there is potentially no ecosystem
impact on prohibiting the issuance of such certificates now, perhaps can we proceed with a short and simple ballot that establishes such a prohibition.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">If others agree, I’d be willing to draft such a ballot. Or, if someone would like to develop the proposal, that’s perfectly fine too.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
<p class="MsoNormal">Corey<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">[1] <a href="https://url.avanan.click/v2/___https:/github.com/orgs/cabforum/projects/1/views/1___.YXAzOmRpZ2ljZXJ0OmE6bzo4YWU2M2M4MWRkNTBjZWRhZTI0YjNlZTgwMzI4NDQ5Yjo2OmRhNmE6ZmNlZDM0NTg5OGMxZWUwZDRkZjgyZDg2NWIwNmIyNDRhMWI5N2ExZDgxOGNlNGNkMmU4YjM5Nzk1ZjA0MDYwNjpoOkY" title="Protected by Avanan: https://github.com/orgs/cabforum/projects/1/views/1">
https://github.com/orgs/cabforum/projects/1/views/1</a><o:p></o:p></p>
<p class="MsoNormal">[2] <a href="https://url.avanan.click/v2/___https:/github.com/cabforum/servercert/issues/153___.YXAzOmRpZ2ljZXJ0OmE6bzo4YWU2M2M4MWRkNTBjZWRhZTI0YjNlZTgwMzI4NDQ5Yjo2OjIwYWU6YjUyYzUyMmFjNjdjNjFkYzUzMjMxMDNmZTI5YmJjMDljN2RmMzEzMjNhMjlhNjNmMTNmYmRlNDM3ZmVlYzJhNTpoOkY" title="Protected by Avanan: https://github.com/cabforum/servercert/issues/153">
https://github.com/cabforum/servercert/issues/153</a><o:p></o:p></p>
<p class="MsoNormal">[3] <a href="https://url.avanan.click/v2/___https:/search.censys.io/search?resource=certificates&q=parsed.extensions.subject_alt_name.dns_names%3A%2F.%2B%5C.arpa%2F+and+parsed.validity_period.not_after%3A%5B2023-08-22+TO+*%5D___.YXAzOmRpZ2ljZXJ0OmE6bzo4YWU2M2M4MWRkNTBjZWRhZTI0YjNlZTgwMzI4NDQ5Yjo2OmJkMmI6YTJkNjBiZDBkNzNiZTNmYWYzYTBlYTkxMjM5NzAxZTZmNmZiYzA0MDllZmYxZmRlN2FhZTdiYTI4MDc1ZDY5YTpoOkY" title="Protected by Avanan: https://search.censys.io/search?resource=certificates&q=parsed.extensions.subject_alt_name.dns_names%3A%2F.%2B%5C.arpa%2F+and+parsed.validity_period.not_after%3A%5B2023-08-22+TO+*%5D">
https://search.censys.io/search?resource=certificates&q=parsed.extensions.subject_alt_name.dns_names%3A%2F.%2B%5C.arpa%2F+and+parsed.validity_period.not_after%3A%5B2023-08-22+TO+*%5D</a><o:p></o:p></p>
</div>
</div>
</body>
</html>