5 ms·

Pretty much what I was thinking. Here's what I almost sent as a response to the survey: This is a brilliant idea. I would pay up to $50 a year for the pleasure

Pretty much what I was thinking. Here's what I almost sent as a response to the survey: This is a brilliant idea. I would pay up to $50 a year for the pleasure of being able to get domain validated SSL certs that are trusted by the major browsers. I would assume that the validation would be via emailing webmaster@domain and making them either respond or click a link or something. That could all be automated couldn't it. Also, make wildcard certificates for domains available for the same low price, because it shouldn't take any more work should it. If I control example.org, then I think it's obvious that I control www.example.org and slighly-biased.example.org. But then you have the issue of, if Org A controls com.au, that doesn't mean they control mywebsite.com.au. I don't know how you would automate that issue. The non-automated stuff, make people pay for it. Seriously.

ehPReth 12y ago
Mozilla created https://publicsuffix.org/ https://publicsuffix.org/ - perhaps that could help with com.au vs. example.com.au?
- raving-richard 12y ago
  That's brilliant. I was wondering if there was a list that actually provided the relevant information. Thanks for the link.
euank 12y ago
Well, one way to automatedly ensure someone controls all the subdomains a wildcard certificate gives would be to ask them to create dns records indicating that. Basically, the CA could say "you want *.example.com, then create a dns txt record at mzzafr2pr.example.com with the following text: F5cbUl7pL2JM7z and click here. We'll get back to you once we see the dns change propagate". If I can create a random subdomain they suggest within a wildcard range, that makes it almost certain I can create every subdomain.
- vladd 12y ago
  This breaks for obvious cases such as mzzafr2pr.blogspot.com
  - willthames 12y ago
    Not really, as while you can make the domain exist you can't make the TXT record appear in DNS.
  - hueving 12y ago
    How so? You would still be subject to clicking on the link in the standard email sent to webmaster@blogspot.com to prove you owned the root.
  - euank 12y ago
    You both have to prove that you own the ability to create dns (with blogspot sorta) and the actual content. The CA provider both lists the record name and value. You do have a good point though. I'm sure there are some services right now that allow decent control of a chosen subdomain's dns, but don't mean for you to be able to create ssl certs valid for all other subdomains too. Perhaps there should be a blacklist of sites like "blogspot". Perhaps there should be a way for a domain to indicate that wildcard certs cannot be automatically created for it without passing other conditions.
vladd 12y ago
The same issue appears when deciding allowance of cookie share-ability across subdomains. The solution is called a public suffix list - more information about it is available at https://wiki.mozilla.org/Public_Suffix_List https://wiki.mozilla.org/Public_Suffix_List .
womble 12y ago
(I'm the sslcoop.org guy) That's essentially the model I'm looking to implement. I prefer DNS modification for domain validation, but anything that can be automated will be.

ehPReth 12y ago

Mozilla created https://publicsuffix.org/ https://publicsuffix.org/ - perhaps that could help with com.au vs. example.com.au?

raving-richard 12y ago
That's brilliant. I was wondering if there was a list that actually provided the relevant information. Thanks for the link.

euank 12y ago

Well, one way to automatedly ensure someone controls all the subdomains a wildcard certificate gives would be to ask them to create dns records indicating that. Basically, the CA could say "you want *.example.com, then create a dns txt record at mzzafr2pr.example.com with the following text: F5cbUl7pL2JM7z and click here. We'll get back to you once we see the dns change propagate". If I can create a random subdomain they suggest within a wildcard range, that makes it almost certain I can create every subdomain.

vladd 12y ago
This breaks for obvious cases such as mzzafr2pr.blogspot.com
- willthames 12y ago
  Not really, as while you can make the domain exist you can't make the TXT record appear in DNS.
- hueving 12y ago
  How so? You would still be subject to clicking on the link in the standard email sent to webmaster@blogspot.com to prove you owned the root.
- euank 12y ago
  You both have to prove that you own the ability to create dns (with blogspot sorta) and the actual content. The CA provider both lists the record name and value. You do have a good point though. I'm sure there are some services right now that allow decent control of a chosen subdomain's dns, but don't mean for you to be able to create ssl certs valid for all other subdomains too. Perhaps there should be a blacklist of sites like "blogspot". Perhaps there should be a way for a domain to indicate that wildcard certs cannot be automatically created for it without passing other conditions.

vladd 12y ago

The same issue appears when deciding allowance of cookie share-ability across subdomains. The solution is called a public suffix list - more information about it is available at https://wiki.mozilla.org/Public_Suffix_List https://wiki.mozilla.org/Public_Suffix_List .

womble 12y ago

(I'm the sslcoop.org guy) That's essentially the model I'm looking to implement. I prefer DNS modification for domain validation, but anything that can be automated will be.