Subject: [dbound] Some work that will probably hit dbound sooner rather than later

From: Paul Hoffman <[email-masked]>
Date: Fri, 29 May 2015 08:03:25 -0700

https://bugzilla.mozilla.org/show_bug.cgi?id=1169149

tl;dr: It is valid for CAs to write certificates for "*.tld" when the TLD is controlled by one organization. Browser vendors want to know which TLDs that is reasonable for, and which (such as "*.com") it is not.

--Paul Hoffman

---

From: Gervase Markham <[email-masked]>
Date: Fri, 29 May 2015 21:36:10 +0100

On 29/05/15 16:03, Paul Hoffman wrote:
> tl;dr: It is valid for CAs to write certificates for "*.tld" when the
> TLD is controlled by one organization. Browser vendors want to know
> which TLDs that is reasonable for, and which (such as "*.com") it is
> not.

Browser software is not the right place to enforce this policy; CAs are.
And the CAB Forum Baseline Requirements say exactly what should be said
- i.e. don't issue such a cert unless the applicant can prove ownership
of the entire domain space.

Gerv

---

From: Jeffrey Walton <[email-masked]>
Date: Fri, 29 May 2015 17:08:24 -0400

On Fri, May 29, 2015 at 11:03 AM, Paul Hoffman <[email-masked]> wrote:
> tl;dr: It is valid for CAs to write certificates for "*.tld" when the TLD is controlled by one organization.
Yes. For example, *.google - its is owned by Google, and controlled by
Google. (I don't have an example of owned by one party but control
delegated to another party).

The trick is determining the intersection of the vanity domain with
ownership/control. I don't know how to solve that one, and I'm waiting
for DBOUND to tell me what the best practice is.

> Browser vendors want to know which TLDs that is reasonable for, and which (such as "*.com") it is not.
This is a different problem.

We know no one individual "owns" or "controls" *.COM, *.NET, etc.
There's no reason to even entertain the possibility. The only time I
have encountered them in the wild (twice now) is when I am under
attack by Burp Suite, Charles Proxy, etc.

Last summer, I even met a pen tester who used them in Burp for iOS
because it made breaking the channel so easy :)

By the way, the IETF appears to claim *.COM, *.NET etc is valid. I
shake my head in disbelief every time someone tells me "but the IETF
does not prohibit it...".

Jeff

---

From: Rubens Kuhl <[email-masked]>
Date: Fri, 29 May 2015 22:11:32 -0300

> On May 29, 2015, at 12:03 PM, Paul Hoffman <[email-masked]> wrote:
> 

My take is that exclusive use registries qualify for *.tld certificates while usual ones or Spec 13 ones do not. 

I will provide some examples.

This one, .globo, would qualify for *.globo:
https://www.icann.org/resources/agreement/globo-2013-12-19-en <https://www.icann.org/resources/agreement/globo-2013-12-19-en>

This one, .barclays, wouldn't for *.barclays:
https://www.icann.org/resources/agreement/barclays-2014-11-20-en <https://www.icann.org/resources/agreement/barclays-2014-11-20-en>

The difference is that the first only allows for its own organisation to use its TLD, while the other allows for other organisations that are brand-licensees to register domains. 

The algorithm would be:
Has no exemption to code of conduct -> Can't have wildcard
Has exemption but allows for carving for licensees -> Can't have wildcard
Has exemption but doesn't allow anyone else to use -> Can have wildcard

Rubens