Wildcard domains are already allowed. We can verify Wildcard DNS because a CNAME for *.domain.com is pointing to a record previously verified. This verification method is permitted under the definition of Authorization Domain Name (where the FQDN returned by a CNAME lookup can be used to verify the requested FQDN). Although <rnd>.domain.com isn’t necessarily distinguishable from *.domain.com, the validation ends up being the same because either its considered an Authorized Domain Name (under the definition) or it was validated as a random value in this new method.
For example: *.domain.com -> dcv.example.com (validated under the Authorized Domain Name section) <rnd>.domain.com ->validation.example.com (validated under this new section) Because each is validated properly, tracking which exact section was used in the validation isn’t necessary. Jeremy From: Ryan Sleevi [mailto:[email protected]] Sent: Friday, September 2, 2016 3:28 PM To: Jeremy Rowley <[email protected]> Cc: [email protected] Subject: Re: [cabfpub] CNAME-based validation Jeremy, Does this introduce risk for sites that use Wildcard DNS records? How would you propose mitigating that risk? On Fri, Sep 2, 2016 at 2:26 PM, Jeremy Rowley <[email protected] <mailto:[email protected]> > wrote: I realized after reviewing my proposal that it will require a new method under the domain validation section. Therefore, I’m proposing we add the following as a new permitted method for domain validation: Add the following as Section 3.2.2.4.11: Confirming the Applicant’s control over the requested FQDN by appending a Random Value or Request Token as a sub domain to an Authorization Domain Name and pointing the CNAME record of the created sub domain to a FQDN verified by the CA using one of methods permitted under Section 3.2.2.4 Looking for two endorsers. Jeremy _______________________________________________ Public mailing list [email protected] <mailto:[email protected]> https://cabforum.org/mailman/listinfo/public
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Public mailing list [email protected] https://cabforum.org/mailman/listinfo/public
