2

while reading Baseline Requirement for Public CA I noticed something.

1.

Authorized Ports: One of the following ports: 80 (http), 443 (http), 25 (smtp), 22 (ssh).

this includes port 22 and implies there is some way to use SSH for something. but in the entire documents it appears only 4 times. First on definition itself, and 3.2.2.4.6 Agreed-Upon Change to Website (needs to be http or https) 3.2.2.4.9 Test Certificate (Must via TLS) 3.2.2.4.10. TLS Using a Random Number (Must via TLS)

As SSH is nether http/https nor use TLS, where is no way to use this port for domain validation(unless you are weirdo runs a webserver on port 22). why CAA included this port? was there a historical method that retired?

0

You wrote:

(unless you are weirdo runs a webserver on port 22)

It sounds weird but I think that is exactly what this is about.

Ryan Sleevi of Google had this to say:

Ryan Sleevi sleevi at google.com 
Fri Mar 2 08:51:19 MST 2018
Previous message: [cabfpub] [Ext] BR Authorized Ports, add 8443
Next message: [cabfpub] [Ext] BR Authorized Ports, add 8443
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]
On Fri, Mar 2, 2018 at 10:08 AM, Paul Hoffman via Public <
public at cabforum.org> wrote:

> On Mar 1, 2018, at 7:51 AM, Ben Wilson via Public <public at cabforum.org>
> wrote:
> >
> > Forwarding from Richard Wang:
> >
> > The current BRs say:
> >
> > Authorized Ports: One of the following ports: 80 (http), 443 (http), 25
> (smtp), 22 (ssh).
> >
> > But many internal networks use the port 8443, broadly used in Apache
> server, today, one of our customers uses this port and can't change to use
> another port, I wish you can help to add this port 8443 to be allowed in
> the BRs, thanks.
>
> It appears that the BRs currently are talking about authorizing
> *services*, not ports. That is, I would not expect to be able to put a HTTP
> server on port 22 on my system and have that considered authorized by the
> BRs.
>

That is intentionally permitted.
[...]

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.