[cabf_validation] Publicly Trusted TLS certs with .arpa domains
tim.hollebeek at digicert.com
Wed Aug 23 16:10:50 UTC 2023
I have wanted to fix this ever since we discovered it at a previous employer.
From: Validation <validation-bounces at cabforum.org> On Behalf Of Corey Bonnell via Validation
Sent: Tuesday, August 22, 2023 5:13 PM
To: CABforum3 <validation at cabforum.org>
Subject: [cabf_validation] Publicly Trusted TLS certs with .arpa domains
In reviewing the project board  for our group, I did some investigation into the "On Deck" item for validation requirements for .arpa domains . It turns out that according to Censys, there are currently no unexpired and publicly trusted certificates have been issued with a .arpa domain name .
When the topic of prohibiting such issuance was raised several years ago, there was some pushback as there were several thousand valid certificates with .arpa domain names at the time. However, given that there is potentially no ecosystem impact on prohibiting the issuance of such certificates now, perhaps can we proceed with a short and simple ballot that establishes such a prohibition.
If others agree, I'd be willing to draft such a ballot. Or, if someone would like to develop the proposal, that's perfectly fine too.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Validation