Subject: [certid] additional security consideration

From: ArkanoiD <[email-masked]>
Date: Thu, 18 Mar 2010 07:07:31 +0300

Second level domain MUST NOT be wildcarded, thus *.com is invalid and should
never match. (as well as "*", of course)

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 17 Mar 2010 22:29:29 -0600

> never match. (as well as "*", of course)

Good point. We seem to have assumed that one...

Peter

-- 
Peter Saint-Andre
https://stpeter.im/

---

From: Joe Orton <[email-masked]>
Date: Thu, 18 Mar 2010 19:50:37 +0000

> never match. (as well as "*", of course)

I don't think it's appropriate for the draft to specify any requirement 
beyond the "left-most label" rule, so far as wildcards go.  I could 
imagine a "*.local" or similar could be useful to allow, and *.com is 
really little more dangerous than *.co.uk.  Yet *.blah.fr is fine.  And 
so on.  The rules could get stupidly complicated really quickly if you 
go down this road.

So, I would just leave it at the "left-most label" rule.  Having a 
simple rule like this is sufficient for interoperability purposes, which 
is the end goal here.  It will remain up to the CAs to validate CN 
sanity beyond that.

Regards, Joe

---

From: Michael Ströder <[email-masked]>
Date: Thu, 18 Mar 2010 20:54:36 +0100

Joe Orton wrote:
> really little more dangerous than *.co.uk.

Good point with *.co.uk but I'd draw the opposite conclusion from it:
I'd rather like to see wildcards forbidden completely or at least strongly
discouraged.

Ciao, Michael.

---

From: Joe Orton <[email-masked]>
Date: Thu, 18 Mar 2010 20:26:51 +0000

> I'd rather like to see wildcards forbidden completely or at least strongly

I don't agree, wildcard certs are very useful in some circumstances.

In any case, I'd hope the goal for this draft is to document current 
best practice, not to move mountains.  Trying to impose a "no wildcards" 
rule without broad consensus from CAs and the browser vendors (good luck 
with that) would harm rather than improve interop.

Regards, Joe

---

From: Michael Ströder <[email-masked]>
Date: Thu, 18 Mar 2010 21:50:20 +0100

Joe Orton wrote:
> best practice,

Whatever one considers to be best practice...

> Trying to impose a "no wildcards" 

Why do you assume that there is broad consensus from CAs and the browser
vendors for wildcard certs?

https://wiki.mozilla.org/CA:Problematic_Practices#Wildcard_DV_SSL_certificates

Ciao, Michael.

---

From: Peter Saint-Andre <[email-masked]>
Date: Wed, 31 Mar 2010 16:15:02 -0600

> I'd rather like to see wildcards forbidden completely or at least strongly

I would, too. There are significant security concerns with them (related
to phishing attacks and such).

However, some CAs will issue wildcard certs to certificate holders who
are more highly verified (e.g., Class 2 certificates requiring identity
verification of some kind). So I think this is an open issue.

Peter

-- 
Peter Saint-Andre
https://stpeter.im/