Re: [saag] subordinate vs intermediate certification authority

[Viktor Dukhovni <[e-mail]>]

On Sat, Feb 06, 2021 at 03:59:37PM -0500, Michael Richardson wrote:

> The issue comes up with pinning as it relates to ownership.  It's not
> a problem if every organization that can own Things has it's own
> private CA.  Pinning that CA works great.  Pinning some other EE is
> very much more specific, but also, may be too ephemeral.
> 
> Where it gets complex is when organizations have outsourced the CA
> function elsewhere.  It's meaningless to pin LetsEncrypt or GoDaddy.
> It might be meaningful to pin a Subordinate CA signed by some public
> CA though.

Are you trying to get at generalising the issue described at:

    http://dnssec-stats.ant.isi.edu/~viktor/x3hosts.html

(where I track sloppy SMTP server operators who've pinned the now retired
Let's Encrypt "X3" CA, and have failed to keep up with the times)?

The number of MX hosts with such TLSA RRs is falling as they eventually
notice (or the issue is brought to their attention).  And, fortunately,
with DANE TLSA RRs published in their DNS zone, they can update the pin
on their end, without having to ask the world to update some local copy.

There is a tiny population of SMTP operators who've attempted to publish
TLSA RRs that pin the EE public key of a provider's SMTP server they
don't control.  That's a mistake, and they eventually figure this out
and drop unmaintainable TLSA RRs for servers they don't control.

-- 
    Viktor.