Subject: [xmpp] 3920bis: wildcards in certs

From: Peter Saint-Andre <[email-masked]>
Date: Thu, 10 Sep 2009 13:11:14 -0600

In a recent message on the vcarddav list, Alexey Melnikov noted what
seems to be a change of IETF policy regarding the inclusion of wildcards
in certificates:

"Based on the discussion during an IESG telechat several ADs agreed that
f* wildcards shouldn't be allowed anymore. So, the document should say
that it complies with RFC 2818, except for f* type wildcards are not
allowed. (wildcards in the leftmost label are still allowed). This is
consistent with the advice from RFC 5280."

http://www.ietf.org/mail-archive/web/vcarddav/current/msg01138.html

Although this preference has not yet been codified anywhere as far as I
know, I tend to agree with it. Therefore I would propose that we change
the following paragraph in Section 15.2.1.1.2 (!) of 3920bis...

From:

   The dNSName MAY contain the wildcard character '*'.  The wildcard
   character applies only to the left-most domain name component or
   component fragment and matches any single component or component
   fragment.  For instance, a dNSName of *.example.com matches
   foo.example.com but not bar.foo.example.com or example.com itself;
   similarly, a dNSName of im*.example.net matches im1.example.net and
   im2.example.net but not chat.example.net or example.net itself.

To:

   The dNSName MAY contain the wildcard character '*'.  The wildcard
   character applies only to the left-most domain name component and
   matches any single component (thus a dNSName of *.example.com matches
   foo.example.com but not bar.foo.example.com or example.com itself).
   The wildcard character is not allowed in component fragments (thus a
   dNSName of im*.example.net is not allowed and shall not be taken to
   match im1.example.net and im2.example.net).

Objections?

Peter

- --
Peter Saint-Andre
https://stpeter.im/