servercert VS list

The current CAB Forum Baseline Requirements call for "Multi-Perspective Issuance Corroboration" [1] i.e. make sure the DNS or HTTP challenge looks the same from several different data centres in different countries.

[1] https://github.com/cabforum/servercert/blob/main/docs/BR.md#...

There's no prohibition against issuing certificates for names on the Public Suffix List.

BR 3.2.2.6 prohibits issuing a wildcard certificate for an entire public suffix unless the "Applicant proves its rightful control of the entire Domain Namespace" (without specifying how this should be done - arguably, publishing a DNS record would qualify) but also says that CAs should use the "ICANN DOMAINS" section of the PSL only, not the "PRIVATE DOMAINS" section, so domains for dynamic DNS providers and the like wouldn't be included in any case. [https://github.com/cabforum/servercert/blob/main/docs/BR.md#...]

That's because some people came along and produced a parallel standard [1] adding loads more rules, clarifications and constraints to convert X509 into something approximately fit for purpose.

[1] https://github.com/cabforum/servercert

This is permitted: https://github.com/cabforum/servercert/blob/main/docs/BR.md#...

But it hasn't really caught on; a lot of registrars don't seem to want the complexity of being (or integrating with) a CA, and vice versa.

It is unfortunate. It's required: https://github.com/cabforum/servercert/blob/main/docs/BR.md#...

No, they don't have to MitM the CA's domain validation request. While they have brief control over the website, they use domain validation method 3.2.2.4.18 (Agreed-Upon Change to Website v2)[1] or 3.2.2.4.19 (Agreed-Upon Change to Website - ACME)[2] to legitimately complete domain validation by making a change to the website.

[1] https://github.com/cabforum/servercert/blob/cda0f92ee70121fd...

...Unless you're savvy. Thank goodness for the availability of https://publicsuffix.org/ (as long as you only use your main domain and don't need to share cookies with your own subdomains), and the includeSubDomains directive to HSTS! But - if you already set this up, you probably are savvy enough to avoid the problems created (or your provider is)

In addition to the fact that .gov.uk and .ac.uk does exist in this list, which has two logical sections where the first section is for official TLDs and the second section is for custom domains, the PSL is effectively being used for additional origin protection: foo.gov.uk and bar.gov.uk should have separate origins because, of course, they can and normally be operated by different entities. So as long as such things can happen, the public registration is not really mandatory for being included to the PSL. (One particular exception is that a generated domain for all possible IP addresses [1], which technically benefit from the inclusion but the maintainers don't want to endorse such unsafe services.)

[1] https://github.com/publicsuffix/list/wiki/Guidelines#validat...

> if a user uploaded something like an html file, you wouldn't want it to be able to run javascript on google.com (because then you can steal cookies and do bad stuff)

Cookies are the only problem here, as far as I know, everything else should be sequestered by origin, which includes the full domain name. Cookies predate the same-origin policy and so browsers scope them using their best guess at what the topmost single-owner domain name is, using—I kid you not—a compiled-in list[1]. (It’s as terrifying as it sounds.)

[1] https://publicsuffix.org/

Let’s start with the endmost certificates. They are usually bound to a given top-level domain (or more precisely — the public suffix). For example, a certificate may be issued to www.thedroidsonroids.com. It may also be a wildcard applicable to any subdomain (like *.thedroidsonroids.com).

I assume you’re using Mozilla’s public suffix list? https://publicsuffix.org/

We have something similar that keeps it updated on a regular basis as well. We used to wait until someone complained, but it changes so often it’s the only reasonable way to deal with it.

perfect use case for the public suffix list (https://github.com/publicsuffix/list)

I just made up `blogger.com` as an example. I probably could have picked a better one. `blogspot.com` & its many TLD variations are on the list.

It looks like the repo where the list is maintained [1] is pretty active. YMMV, I'm not a maintainer or anything..

[1] https://github.com/publicsuffix/list

There's the Public Suffix List https://publicsuffix.org/ but it's limited to domain names, so your github.com/rails example isn't covered. I'm pretty sure HN simply has a manually coded list of URL patterns for popular domains.