Re: [Secdispatch] Requesting agenda time for draft-rsalz-use-san

I did a quick look at what CABForum has on this. They are in the same state.

Given that CABForum has the ability to actually enforce a profile and given
that this has been in place since we EOLed RSA1024, it is highly unlikely
that there are any browsers currently in use that rely on the CN field.

These are the EV guidelines but I doubt anyone does different for DV.

This change should be synchronized with CABForum if people want this
properly dead.

https://cabforum.org/wp-content/uploads/CA-Browser-Forum-EV-Guidelines-v1.7.0.pdf

Contents: If present, this field MUST contain a single Domain Name(s) owned
or controlled by the Subject and to be associated with the Subject’s
server. Such server MAY be owned and operated by the Subject or another
entity (e.g., a hosting service). Wildcard certificates are not allowed for
EV Certificates except as permitted under Appendix F.

On Thu, Feb 4, 2021 at 10:44 AM Salz, Rich <rsalz=
40akamai.com@dmarc.ietf.org> wrote:

> I would like to present
> https://datatracker.ietf.org/doc/draft-rsalz-use-san/
>
> This updates RFC 6125 to remove commonName as a way to identify the
> server; just use subjectAltName.  It also limits where the "*" can go in
> wildcard certificates. This is a simplification of widely implemented
> existing practice. It may even be de facto what's mostly done. Perhaps the
> wildcard limitation is controversial and I'd be willing to remove it.
>
> 6125 was AD-sponsored. I think this could also be, or perhaps it could go
> to UTA. I would not present any slides, and think 10-15 minutes would be
> enough time.
>
>
> _______________________________________________
> Secdispatch mailing list
> Secdispatch@ietf.org
> https://www.ietf.org/mailman/listinfo/secdispatch
>