Add advice on CNs

[benl@…]

Some CAs would like to include CNs even though they are deprecated. If using name redaction, what should go in the CN? Add advice somewhere to suggest they use the base domain name (which will also have to be added as a SAN).

[benl@…]

It would be nice if someone (maybe Google) would test whether omitting CNs actually causes any problem.

[benl@…]

In fact we think that removing CNs will break some tiny percentage of devices, and so we should allow a single CN, which, if present, uses the first entry in the redaction list.

[rob.stradling@…]

The mailing list (also, see ticket #42) is currently discussing the dangers of the name redaction mechanism. I think that discussion needs to reach a firm conclusion on whether name redaction should ever be allowed before we can continue progress on this ticket. (If name redaction is never allowed, then this ticket is pointless and should be marked WONTFIX).

[eranm@…]

Ticket #54 addresses this, marking as duplicate.

[rob.stradling@…]

Replying to eranm@…:

Ticket #54 addresses this, marking as duplicate.

It turns out that the initial proposal in ticket #54 doesn't actually work. Reopening this ticket.

[rob.stradling@…]

We'll use Ben's proposal from comment:2:
"...we should allow a single CN, which, if present, uses the first entry in the redaction list."

Let's require the Subject CN, if present, to match the first dNSName in the SAN extension, so that they can both use the first entry in the redaction list.

[rob.stradling@…]

Committed as...
​https://github.com/google/certificate-transparency-rfcs/commit/49de5eb87e1e6d29e50c418c00654a79a950522d

[rob.stradling@…]

It's problematic to require the Subject CN, if present, to match the first SAN dNSName. See this thread for discussion:
​https://mailarchive.ietf.org/arch/msg/trans/q3mT1tSeKJkh2TDftElF8WBlLp8

Let's adopt Peter Bowen's suggestion to "...append one more element to
the sequence for CN redaction level. I think it should go at the end,
rather than the beginning, as it should be more likely to not have a
common name than not having a SAN."

[rob.stradling@…]

Fixed by ​https://github.com/google/certificate-transparency-rfcs/commit/11b145a7c9865dd8e6f04c6edb19e6fdc4b1a174