Subject: [Acme] issuance to eTLDs

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 10 Oct 2016 19:44:12 -0600

Section 9.5 of draft-ietf-acme-acme-03 suggests that a CA might check 
whether an identifier is an eTLD (i.e., is on the Public Suffix List). 
What is the intended outcome of the checks described in this section? Is 
it that the CA not issue a certificate to the applicant, or do so only 
after completing additional and perhaps manual (albeit currently 
unspecified) verification steps?

Peter

---

From: Richard Barnes <[email-masked]>
Date: Mon, 10 Oct 2016 21:54:29 -0400

Ultimately, it's up to the CA to decide what names it's willing to issue
for.  (There are other controls on those decisions, such as the CABF
Baseline Requirements [1].)  Typically, CAs refuse to issue for names on
the PSL, or at least have big procedural fences around such issuance.  But
if a CA clears all the policy gates to issue for an eTLD (say one of those
ccTLDs with an A record), then they can do so.

In any case, this is not something about which the spec can be normative.
The only reason it's in there at all is that it's one of the common checks
that CAs do, so it made sense to have as an example.

--Richard

[1] See the definition of Base Domain Name in
https://github.com/cabforum/documents/blob/master/docs/BR.md

On Mon, Oct 10, 2016 at 9:44 PM, Peter Saint-Andre <[email-masked]>
wrote:

> whether an identifier is an eTLD (i.e., is on the Public Suffix List). What
> is the intended outcome of the checks described in this section? Is it that
> the CA not issue a certificate to the applicant, or do so only after
> completing additional and perhaps manual (albeit currently unspecified)
> verification steps?
>
> Peter
>
> _______________________________________________
> Acme mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/acme
>

---

From: Peter Saint-Andre <[email-masked]>
Date: Mon, 10 Oct 2016 21:21:13 -0600

On 10/10/16 7:54 PM, Richard Barnes wrote:
> for.

Agreed.

> (There are other controls on those decisions, such as the CABF
> the PSL, or at least have big procedural fences around such issuance.

Sure. the CABF spec currently says:

   Determination of what is “registry‐controlled” versus the
   registerable portion of a Country Code Top‐Level Domain Namespace is
   not standardized at the time of writing and is not a property of the
   DNS itself. Current best practice is to consult a “public suffix
   list” such as http://publicsuffix.org/ (PSL), and to retrieve a fresh
   copy regularly. If using the PSL, a CA SHOULD consult the "ICANN
   DOMAINS" section only, not the "PRIVATE DOMAINS" section.

So it's not necessarily the PSL per se. But CABF is merely one example 
of a potential policy, I suppose.

> But if a CA clears all the policy gates to issue for an eTLD (say one of
> those ccTLDs with an A record), then they can do so.
>
> In any case, this is not something about which the spec can be
> normative.  The only reason it's in there at all is that it's one of the
> common checks that CAs do, so it made sense to have as an example.

Fair enough. Thanks for the reply.

Peter

> On Mon, Oct 10, 2016 at 9:44 PM, Peter Saint-Andre <[email-masked]
> <mailto:[email-masked]>> wrote:
>
>     Section 9.5 of draft-ietf-acme-acme-03 suggests that a CA might
>     check whether an identifier is an eTLD (i.e., is on the Public
>     Suffix List). What is the intended outcome of the checks described
>     in this section? Is it that the CA not issue a certificate to the
>     applicant, or do so only after completing additional and perhaps
>     manual (albeit currently unspecified) verification steps?
>
>     Peter
>
>     [email-masked] <mailto:[email-masked]>
>     <https://www.ietf.org/mailman/listinfo/acme>
>
>

---

From: Daniel Kahn Gillmor <[email-masked]>
Date: Wed, 12 Oct 2016 01:39:33 -0400

> of a potential policy, I suppose.

making matters more confusing, the PSL itself these days contains two
different values -- one of them related to PSL for the purposes of
cookie-setting, and the other one for X.509 certificate issuance.

As it says in the Divisions section of https://publicsuffix.org/list/ :

>> While some applications, such as browsers when considering
>> cookie-setting, treat all entries the same, other applications may
>> wish to treat ICANN domains and PRIVATE domains differently. For
>> example, Certification Authorities checking for wildcard misissuance
>> would not issue a "*.com" wildcard cert ("com" is in the ICANN
>> domains list) but could legitimately issue a "*.appspot.com" wildcard
>> cert to the domain owner, in this case Google ("appspot.com" is in
>> the PRIVATE domains list).

if only we'd managed to get DBOUND better focused we might have
something properly scalable to plug in here, alas :/ 

   --dkg