[cabfpub] Definition of an SSL certificate

Jeremy Rowley jeremy.rowley at digicert.com
Fri Jan 3 16:19:08 UTC 2014


Many of the trusted QC issuers (and other community issuers) are not
involved in the CAB Forum.  Although you are aware of the requirements, I
don't think this knowledge is global.  For example, I don't think the NIST
CP or FBCA CP ever mentions domain validation. A CA following either CP for
client certs wouldn't necessarily validate an included domain.

 

Jeremy

 

From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org] On
Behalf Of Mads Egil Henriksveen
Sent: Friday, January 03, 2014 4:52 AM
To: Moudrick M. Dadashov; Jeremy Rowley; public at cabforum.org
Subject: Re: [cabfpub] Definition of an SSL certificate

 

Hi Moudrick

 

There might not be a real use case for including a domain name in a QC, but
as a trusted CA we take the responsibility for the accuracy of information
in all certs we issue. And that was my point and why I am not very concerned
about the described attack scenario.  

 

Regards

Mads

 

From: public-bounces at cabforum.org [mailto:public-bounces at cabforum.org] On
Behalf Of Moudrick M. Dadashov
Sent: 3. januar 2014 11:51
To: Mads Egil Henriksveen; Jeremy Rowley; public at cabforum.org
Subject: Re: [cabfpub] Definition of an SSL certificate

 

Mads,

On 1/3/2014 11:49 AM, Mads Egil Henriksveen wrote:

 

The attack scenario assumes that the QC can be chained to a root cert in a
trusted CA root store. This means that the CA should know the root store
requirements and should be aware of the risk issuing any cert that could be
used as an SSL certificate. 

 

Buypass do issue both QC and SSL certificates and with the DigiNotar attack
back in 2011 we realized that the browsers do accept a lot of certificates
as SSL certificates. Since then we have had strict controls to ensure that
no certificate is issued with an unverified domain name. I guess most of the
trusted QC issuers who also issue SSL certificates are aware of this, I
would not be very concerned about this attack scenario. 

What is the use case when in a QC we'd need a [any/unverified] domain name?
(aren't CAs responsible for the accuracy of information in the QCs they
issue?). 

 

However, I do support the idea of a technical definition of an SSL
certificate and I like the proposal from Ryan Hurst requiring the BR/EV
OIDs. 

Under ETSI framework compliance assumes two things: compliance with the
corresponding requirements plus certificate profile compliance. These two
categories exist as separate documents (under their own ETSI IDs).
Ryan's proposal is definitely a  good step forward, I'd vote with my both
hands if we go even further, and like ETSI, have separate BR/EV profile
specifications.

Thanks,
M.D.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20140103/66129707/attachment-0003.html>


More information about the Public mailing list