Subject: Re: [certid] open issue: wildcards in component fragments

From: "Jeffrey A. Williams" <[email-masked]>
Date: Tue, 12 Oct 2010 14:30:00 -0500 (GMT-05:00)

Joe and all,

  I concur.  

-----Original Message-----
>From: Joe Orton <[email-masked]>
>Sent: Oct 12, 2010 5:00 AM
>To: [email-masked]
>Subject: Re: [certid] open issue: wildcards in component fragments
>
>On Mon, Oct 11, 2010 at 12:43:29PM -0600, Peter Saint-Andre wrote:
>> Speaking of which, someone contacted Jeff and me off-list about some
>> research results showing that of a very large number of certificates
>> presented by TLS-protected websites, less than 0.01% contain wildcards
>> in component fragments. Given that minuscule level of deployment, I
>> don't see good reasons to spend more cycles on the topic.
>
>The relative number of certs is less relevant than how widely those 
>certs are used, surely.  I checked the "top 1m sites" database from:
>
>http://blog.johnath.com/2009/01/21/ssl-information-wants-to-be-free/
>
>- 382860 total sites (hostnames) returned a cert
>- 94438 of total sites used a wildcard cert (24%)
>- 5% of total sites use the wildcard cert with CN=*.blogger.com
>   ... other blogging/mass-hosting sites similarly high usage
>
>Only a handful (5) use the "f*.example.com" form; all those were certs 
>issued by the GoDaddy and starfieldtech.com CAs.
>
>I support Martin's arguments that the "f*.example.com" form specified in 
>RFC 2818 should be supported.
>
>Regards, Joe
>_______________________________________________
>certid mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/certid

Regards,
Jeffrey A. Williams
"Obedience of the law is the greatest freedom" -
   Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827

---

From: "Jeffrey A. Williams" <[email-masked]>
Date: Wed, 13 Oct 2010 16:55:22 -0500 (GMT-05:00)

Peter, Rex, and all,

-----Original Message-----
>From: Peter Saint-Andre <[email-masked]>
>Sent: Oct 13, 2010 4:52 PM
>To: [email-masked]
>On 10/13/10 3:39 PM, =JeffH wrote:
>>> Note that at least two technology communities have forbidden wildcard
>>> certificates:
>>>
>>> 1. RFC 5992 forbids wildcard certificates in the SIP community.
>>>
>>> 2. The CA/Browser Forum doesn't allow issuance of wildcard certificates
>>> under its "Extended Valuation Certificates" profile.
>>>
>>> So there is some precedent for forbidding wildcard certificates. Is that
>>> a best current practice? Should this I-D state that wildcard
>>> certificates (of whatever variety) are NOT RECOMMENDED?
>> 
>> 
>> I'm thinking that the latter is the way to go wrt wildcards. RFC2119 sez..
>> 
>> 4. SHOULD NOT   This phrase, or the phrase "NOT RECOMMENDED" mean that
>>    there may exist valid reasons in particular circumstances when the
>>    particular behavior is acceptable or even useful, but the full
>>    implications should be understood and the case carefully weighed
>>    before implementing any behavior described with this label.
>> 
>> ..which certainly sounds reasonable for this situation.
>> 
>> Our working copy of -tls-server-id-check (which are trying to pub by end
>> of this week) has further clarifications wrt the spec's not outright
>> forbidding current practice and various other current specifications,
>> thus present wildcard use does not necessarily conflict with such a "NOT
>> RECOMMENDED" stance. Plus such a stance aligns better with the EV
>> Guidelines, RFC5992, and perhaps other specs going forward.
>
>Jeff and I have been thinking about this independently today, and it
>seems we're going in the same direction. Following Martin Rex's argument
>to its logical conclusion has led me to believe that wildcards deserve
>to be NOT RECOMMENDED in a best current practice document.

  I agree completely.
>Peter
>-- 
>Peter Saint-Andre
>https://stpeter.im/

Regards,
Jeffrey A. Williams