[cabfpub] FW: FW: New subject -- Applicant/Subscriber versus domain Registrant

kirk_hall at trendmicro.com kirk_hall at trendmicro.com
Fri Nov 20 21:59:17 UTC 2015


Reposting with permission

From: Peter Bowen [mailto:pzbowen at gmail.com]
Sent: Thursday, November 19, 2015 6:17 PM
To: Kirk Hall (RD-US)
Cc: CABFPub (public at cabforum.org)
Subject: Re: [cabfpub] FW: New subject -- Applicant/Subscriber versus domain Registrant

Kirk,

I think there is only one small missing part in your simplification.  In your first paragraph, your define:
Company 1 = Web Hoster
Company 2 = Domain Registrant

I'm suggesting that an employee/representative of Company 2 might be the one receiving and responding to the email, not an employee/representative of Company 1.  Proving _who_ (e.g which company) responded to the email is the challenge.

Thanks,
Peter

(Permission to repost granted)

On Thu, Nov 19, 2015 at 5:36 PM, kirk_hall at trendmicro.com<mailto:kirk_hall at trendmicro.com> <kirk_hall at trendmicro.com<mailto:kirk_hall at trendmicro.com>> wrote:
[Reposting with permission, and responding]

If I understand your example and concern below, you are saying the one company Company 1 may end up getting certs (even with the name “Company 1” in the O field for OV and EV certs) for a domain that is actually registered in WhoIs to Company 2, and Company 1 and Company 2 have no common corporate ownership and are not affiliates.  Did I simplify the facts correctly?

And you are saying in that situation Company 1 does not “own or control” the domain belonging to Company 2, so we should change the wording in BR 3.2.2.4 to recognize that in the domain validation process there can be cases where the Applicant does not actually “own or control” the domain, such as the situation above.  Did I (oversimplify) that correctly?

If I have understood your statement of the problem being addressed, I don’t think I agree with your conclusion.  If Company 1 is able to demonstrate practical “control” over the domain being validated by current validation methods 2-6 (or revised validation methods 2-9), then to me “ownership or control” has been demonstrated by Company 1, even if there is no obvious connection between the Applicant (Company 1) and the registered domain owner (Company 2).  If Company 1 can respond to one of the permitted email addresses, or can do a practical demonstration for the domain being validated, to me that is sufficient “control” to provide the cert.

If I have mischaracterized your comments, please excuse me.

I don’t think the current language in BR 3.2.2.4 presents any problem we need to address.  To me, the much bigger issue beyond the narrow wording of BR 3.2.2.4 is, who is the “Applicant”, who automatically becomes the “Subscriber” after acceptance by the CA through the rest of the BRs.  I think it must be the company that owns the website (and the cert) in question – in this case, Company 1 above - and not any agent or web hoster who is handling matters for Company 1 (and also not the WhoIs Registrant in this example, Company 2).

If we add any ambiguity or flexibility to who is (or may be) the Applicant, than all the other references to the Applicant and later to the Subscriber in the BRs become very unclear – in that case, who are we talking about, Company 1, the web hoster, or Company 2 – or yet someone else who has helped in getting the domain validation completed?  In fact, the Applicant and Subscriber agree to massive obligations to the CA and to the public under the rest of the BRs (and usually in the Subscriber Agreement between the Applicant/Subscriber and the CA), and we can’t afford any ambiguity about exactly who that is in all cases, even if the Applicant is helped by third parties as their agents, such as web hosters.

From: Peter Bowen [mailto:pzbowen at gmail.com<mailto:pzbowen at gmail.com>]
Sent: Thursday, November 19, 2015 5:19 PM
To: Kirk Hall (RD-US)
Cc: CABFPub (public at cabforum.org<mailto:public at cabforum.org>)
Subject: Re: [cabfpub] New subject -- Applicant/Subscriber versus domain Registrant

Kirk,

I think this has veered a little off course.  The scenario you describe is not the one I'm worried about.  Let me try to describe the scenario that I'm trying to ensure is clearly covered in the revised 3.2.2.4 (as it is a common scenario).

Contoso Ltd. registeres contoso.com<http://contoso.com>.  All contacts in the whois data for contoso.com<http://contoso.com> point to the Contoso Ltd corporate mailing address and all contact emails are ckent at contoso.com<mailto:ckent at contoso.com>.

Fabrikam, Inc. registeres fabrikam.com<http://fabrikam.com>.  All contacts in the whois data for fabrikam.com<http://fabrikam.com> point to the Fabrikam, Inc coporate mailing address and all contact emails are bwayne at fabrikam.com<mailto:bwayne at fabrikam.com>

Example Service Corporation is a service provider located in Ames, Iowa in the United States.

Contoso, Fabrikam, and Example Service Co not affiliates of each other; they share no common ownership or control.

Example Service Corporation applies for a certificate with the Subject of "/C=US/ST=Iowa/L=Ames/O=Example Service Corporation" and two dNSNames in the subjectAltName extension: images.contoso.com<http://images.contoso.com> and blog.fabrikam.com<http://blog.fabrikam.com>.  The CA operator first performs verification of Example Service Corporation according to the BRs.  After this completing this verification, the CA sends emails to ckent at contoso.com<mailto:ckent at contoso.com> and bwayne at fabrikam.com<mailto:bwayne at fabrikam.com> to validate that Example Service Corporation has approval to get a certificate with the respective FQDNs.  After each responds, the CA issues the certificate.

I think that this is a fairly standard process and is compliant with the BRs today.  However the changes to 3.2.2.4 suggest that Line E (option 3) must show the "Applicant’s domain ownership or control".  Some auditors or relying parties might suggest that simply having the Registrant respond to the email may not prove that the Applicant is the 'owner' of the domain nor that the Applicant has control of the FQDN.

I am proposing the changes to ensure that it is clear that an email to the registrant alone is sufficient to meet the requirements.

Thanks,
Peter

(permission to repost is granted)

TREND MICRO EMAIL NOTICE

The information contained in this email and any attachments is confidential

and may be subject to copyright or other intellectual property protection.

If you are not the intended recipient, you are not authorized to use or

disclose this information, and we request that you notify us by reply mail or

telephone and delete the original message from your mail system.



_______________________________________________
Public mailing list
Public at cabforum.org<mailto:Public at cabforum.org>
https://cabforum.org/mailman/listinfo/public


<table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential 
and may be subject to copyright or other intellectual property protection. 
If you are not the intended recipient, you are not authorized to use or 
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.cabforum.org/pipermail/public/attachments/20151120/07032ef0/attachment-0003.html>


More information about the Public mailing list