Re: [apps-discuss] "finding registered domains"

[Andrew Sullivan <[e-mail]>]

On Tue, Mar 12, 2013 at 06:58:28PM -0400, Murray S. Kucherawy wrote:
> In my use case, it's defined that an example.com policy is used (if it
> exists) in the absence of a foo.bar.example.com policy.  The problem is I
> don't know how far up the tree to make that second query.

In order for that to be defined, you put a SOPA record at
foo.bar.example.com that says "example.com".  If you have no SOPA
record, the policy for foo.bar.example.com is "nobody else shares
this".  This is a "default closed" policy, which I think has to be the
right one.  

There's something slightly awkward about this for the CA case,
however, when you have deep trees and you want a wildcard cert that
descends the tree from example.com.  I'm still not sure what to do
about that, because it's going to be impossible to enumerate all the
names under a wildcard (and anyway, you can't do multi-label
wildcards).  I remain a little unhappy about this, but it strikes me
that anyone doing wildcard certs for deep trees may be in a world of
hurt anyway, and it would be better to add an additional SOPA record
for (for instance) *.oneIactuallyWant.example.com.

> So in my case I explicitly will believe the parent/grandparent/whatever
> statement, but I don't know how far up to go, and I don't want to ask
> everyone; I only want to ask at most two questions.

As long as you have the pointer up the tree, that should work.

A

-- 
Andrew Sullivan
[e-mail]