3 ms·
What you're saying is true, but in the context of CAs, it's still important to be able to distinguish real public suffixes from regular authority delegations fo
by pfg 11y ago
What you're saying is true, but in the context of CAs, it's still important to be able to distinguish real public suffixes from regular authority delegations for subdomains. CAs need to be able to filter and block CSRs for wildcard names like *.co.uk or something similar. This also applies to things like cookie scopes in browsers. Currently, the Public Suffix List is your best bet here.
The Dbound WG[1] is working towards a standardized solution that doesn't require enumeration in a centralized list but rather works through DNS records. This should eventually replace the PSL, although I suspect most use cases will still rely on some kind of preload list (similar to HSTS) in addition to that.
[1]: https://tools.ietf.org/wg/dbound/ https://tools.ietf.org/wg/dbound/
- Animats 11y agoThere's an authority delegation problem where "example.com" wants to delegate "adblaster.example.com" to some ad service. The owner of "example.com" needs to approve this, but the party named in the certificate is not "example.com", but the AdBlaster service. On the other hand, since this feature is used almost solely for advertising, there's no reason Let's Encrypt should offer this service for free. Let the ad guys buy those certs from Verisign and verify them with both parties manually.