Subject: Re: [keyassure] [DNSOP] [TLS] [pkix] Cert Enumeration and Key Assurance With DNSSEC

From: Tony Finch <[email-masked]>
Date: Tue, 5 Oct 2010 12:15:59 +0100

Moving this to the keyassure mailing list. It's probably also on topic for
pkix but i'm not subscribed there.

On Mon, 4 Oct 2010, Phillip Hallam-Baker wrote:
>
> The way I see this working is that each CA would publish a record that
> customers could publish in their DNS zone to state that other CAs should not
> issue certs. This would have the Digest of either the root key or an
> intermediate cert.

This could presumably also cover a private CA cert or a self-signed
certificate that is being used without any chain.

> Once the necessary record is allocated, a proposal is made to CABForum to
> require all member CAs to verify every cert against these DNS records before
> issue. I believe that there should be a very high degree of voluntary
> compliance since it is a check that can be automated.
>
> After a short interval the mechanism is made mandatory. The browser and
> platform providers have the necessary tools to achieve this. They can
> require the checks to be specified in the annual WebTrust audit which means
> that every cert would have to be in compliance within a year.
>
> Non compliant certificates would be detected as a matter of course by the
> various companies who have reason to crawl the Web and look at SSL certs.
>
> Note that my approach does not require client implementation to be
> effective, but allows for client implementation if this is considered
> desirable and is equally effective as a means of client side enforcement.

I like this dual approach a lot.

Tony.
-- 
f.anthony.n.finch  <[email-masked]>  http://dotat.at/
HUMBER THAMES DOVER WIGHT PORTLAND: NORTH BACKING WEST OR NORTHWEST, 5 TO 7,
DECREASING 4 OR 5, OCCASIONALLY 6 LATER IN HUMBER AND THAMES. MODERATE OR
ROUGH. RAIN THEN FAIR. GOOD.

---

From: Adam Langley <[email-masked]>
Date: Tue, 5 Oct 2010 10:23:45 -0400

>> compliance since it is a check that can be automated.

Yes, this would be a useful incentive to adoption. However, we're a
ways off having a proposal solid enough for this yet.

-- 
Adam Langley [email-masked] http://www.imperialviolet.org