> On 2 Sep 2016, at 6:21 PM, Jeremy Rowley <[email protected]> wrote: > > Then I suppose I don't understand the objection. The subdomain will always be > a random value provided by the CA. This is distinguishable from the case of > .well-known. Are you suggesting there should be a DNS record similar to > well-known? That would be a happy resolution for me. > <rnd>.pki_validation.domain.com?
My point is that you can’t just say “this person could create a randomly named subdomain, therefore he must control the domain”, because there are known examples of domains where anyone can create a named subdomain if it’s not already taken. I’m not making a suggestion for a solution because I don’t have a good one. As far as I know there is not a DNS equivalent of /.well-known. A solution would have to either be something that by chance already works, or would have to wait to be adopted by all affected domains. > -----Original Message----- > From: [email protected] [mailto:[email protected]] > Sent: Friday, September 2, 2016 7:15 PM > To: Jeremy Rowley <[email protected]> > Cc: [email protected] > Subject: Re: [cabfpub] CNAME-based validation > > Yes, in this case the random value is represented as ‘1023456789ABCDEF’. > >> On 2 Sep. 2016, at 5:38 pm, Jeremy Rowley <[email protected]> wrote: >> >> In this case it must be a random value provided by the ca that is then used >> to create the sub domain. It must follow all other rules related to random >> values (valid only for 30 days, unique per message,etc) >> >> On Sep 2, 2016, at 5:19 PM, Geoff Keating <[email protected]> wrote: >> >>> >>>> On 2 Sep. 2016, at 2:26 pm, Jeremy Rowley <[email protected]> >>>> wrote: >>>> >>>> I realized after reviewing my proposal that it will require a new method >>>> under the domain validation section. Therefore, I’m proposing we add the >>>> following as a new permitted method for domain validation: >>>> >>>> Add the following as Section 3.2.2.4.11: >>>> >>>> Confirming the Applicant’s control over the requested FQDN by appending a >>>> Random Value or Request Token as a sub domain to an Authorization Domain >>>> Name and pointing the CNAME record of the created sub domain to a FQDN >>>> verified by the CA using one of methods permitted under Section 3.2.2.4 >>>> >>>> Looking for two endorsers. >>> >>> I would be concerned about this for the case of domains that allow >>> user-created subdomains. For example, if the CA says I need to create >>> 1023456789ABCDEF.github.com, I can probably just go do that. We dealt with >>> this for web sites by requiring they’d be under /.well-known. >>> >
smime.p7s
Description: S/MIME cryptographic signature
_______________________________________________ Public mailing list [email protected] https://cabforum.org/mailman/listinfo/public
