Re: [homenet] I-D Action: draft-ietf-homenet-dot-10.txt

["Walter H." <[e-mail]>]

On Tue, August 1, 2017 11:52, Toke Høiland-Jørgensen wrote:
>>> you couldn't use the fact that you can publish in a name in it
>>> to do the ACME authentication.
>>
>> there SHOULD NOT be the ACME authentication or any neccessarity of any
>> other authentication, as these domain names need not be unique ...
>>
>> in case you use 'teddynet.home.arpa.' and I use this domain name, too;
>> we wouldn't have the same x509 SSL certificate, because each of us uses
>> its own private key ...
>>
>> why not just define the org. that hosts the ARPA TLD (IANA?), as the CA
>> for these domains and the root certificate as built in token to the
>> common
>> browsers and/or operating systems?
>> there it should only be neccessary to upload the certificate request,
>> gicwn the '.home.arpa.' domain name, and an email address where the
>> certificate is sent to;
>> the certificate will be a wild card certificate for this .home.arpa.
>> domain ..
>>
>> I would want this to be added as additional section to this Draft/RFC;
>
> If you're going through all this trouble of having a central API that
> will hand out certificates,

this need not neccessarily be a central API, just a sort of rules, to make
the existing CAs hand out the certificate without the need of any
authentication ...

> wouldn't it be possible to make that same
> authority hand out pseudo-random unique subdomains (of some suitable
> domain; not necessarily .home.arpa)?

are you talking about a TLD e.g. ".home" which is as the other TLDs like
.com or .net or even .at with the difference, that the authoritatativ DNS
servers of such a domain needn't be accessible from internet ...; and this
registration could hand out the certificates, too;

> Then you are only an NS record from
> solving the globally visible naming problem... :)

with the thought above these aren't globally visible and there is no need to;
but the risk that a misconfiguration tells the folks the LAN structure ...