How to create a dns allow policy that can use sub-sub domains?

[akumar-xyz]

Hello!

• Vote on this issue by adding a 👍 reaction
• If you want to document this feature, comment to let us know (we'll work with you on design, scheduling, etc.)

Affected area/feature

When configuring CA issuance policy, how to allow all sub-sub domains i.e. wildcard that expands to multiple labels?

For clarity:

1. *.acme.com
   • MATCHES xyz.acme.com
   • NOT MATCH xyz.cloud.acme.com
2. *.*.acme.com - NOT ALLOWED (cannot parse permitted URI domain constraint "*.*.acme.com": URI domain constraint "*.*.acme.com" can only have wildcard as starting character)
3. .acme.com - NOT ALLOWED (cannot parse permitted domain constraint ".acme.com": domain constraint ".acme.com" with wildcard should start with *)

I also tried 3 because RFC5280 states:

When the constraint begins with a period, it MAY be
expanded with one or more labels. That is, the constraint
".example.com" is satisfied by both host.example.com and
my.host.example.com. However, the constraint ".example.com" is not
satisfied by "example.com".

As far as I can tell, the matching rules are more similar to RFC2818 which would mean what I'm trying to do is not possible.

Is it possible to match for all sub-sub domains with just one rule? Something like **.acme.com?
Is the only solution to maintain a list of subdomains as well?

[hslatman]

Hey @akumar-xyz, thank you for opening the issue.

For the current implementation we decided our issuance policies had to be simple to configure, and thus we decided to put limits on the usage of the wildcard to a single label. While it's true that the evaluation rules are similar to how X509 Name Constraints are defined and evaluated, they're not exactly the same, the main reason for which is to keep things simple.

If you need wildcards on multiple labels you'll indeed need to keep track of the subdomains, and define a rule for each. Or instead of using an issuance policy, you can implement a webhook receiver to fully control when a certificate is allowed to be signed using our webhooks support.

[filimonic]

By default, server allows everything, but constraints are too tight.

I think need something in the middle - to restrict domains, but allow any level of subdomains.

Technically seems that this behavior is controlled with this line and nothing more.

Maybe it will be good to add here and there one more flag restrictedWildcardToSingleLevel:true by default (seems this is easy enough)

Or add one more template format - %.example.com which means % matches 1 or more subdomains. This will be more complex as code drops asterisk sign internally.