Re: [certid] additional security consideration

[Michael Ströder <[e-mail]>]

Joe Orton wrote:
> On Thu, Mar 18, 2010 at 08:54:36PM +0100, Michael Ströder wrote:
>> Joe Orton wrote:
>>> On Thu, Mar 18, 2010 at 07:07:31AM +0300, ArkanoiD wrote:
>>>> Second level domain MUST NOT be wildcarded, thus *.com is invalid and should
>>>> never match. (as well as "*", of course)
>>>
>>> I don't think it's appropriate for the draft to specify any requirement 
>>> beyond the "left-most label" rule, so far as wildcards go.  I could 
>>> imagine a "*.local" or similar could be useful to allow, and *.com is 
>>> really little more dangerous than *.co.uk.
>>
>> Good point with *.co.uk but I'd draw the opposite conclusion from it:
>> I'd rather like to see wildcards forbidden completely or at least strongly
>> discouraged.
> 
> I don't agree, wildcard certs are very useful in some circumstances.
> 
> In any case, I'd hope the goal for this draft is to document current 
> best practice,

Whatever one considers to be best practice...

> Trying to impose a "no wildcards" 
> rule without broad consensus from CAs and the browser vendors (good luck 
> with that) would harm rather than improve interop.

Why do you assume that there is broad consensus from CAs and the browser
vendors for wildcard certs?

https://wiki.mozilla.org/CA:Problematic_Practices#Wildcard_DV_SSL_certificates

Ciao, Michael.