[cabf_validation] Domain Validation update for discussion

[Doug Beattie]

I must have missed the discussion around the topics in this new addition:

*        The CA MUST generate and use a new Random Value, Request Token, or Test Certificate for each Authorization Domain validated and MUST NOT rely on a Random Value, Request Token or Test Certificate generated more than 30 days prior completing verification under this section

What was the reasoning behind using different values for different Authorized Domain (not even sure what this means because we are validating FQDNs, not Authorized Domains..) and why the value is limited to 30 days?

If someone orders a multi-san cert the CA should be able to use the same value for all the SANs in the cert when using DNS or a file (maybe not the email validation).  Why do we need to have a lot of different values for one request for a certificate (what we normally call an  "order")?

If people add and remove SANs from that cert (the "order"), the same random value should be able to be used for the life of the order as long as the time between creating that token (when the request for the cert was first placed) and using it is less than 39 months, it should be acceptable.  Was there a security reason to limit the validity of the random value?

Doug



From: validation-bounces at cabforum.org [mailto:validation-bounces at cabforum.org] On Behalf Of Jeremy Rowley
Sent: Thursday, June 18, 2015 3:26 PM
To: validation at cabforum.org
Subject: [cabf_validation] Domain Validation update for discussion


-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://cabforum.org/pipermail/validation/attachments/20150621/0c91ef41/attachment.html