BR 翻譯小站 BR Trans Desk
附錄 B 已翻譯 對應原文版本：2.3.0

對 Onion 網域名稱簽發憑證

跳至原文

Issuance of Certificates for Onion Domain Names

This appendix defines permissible verification procedures for including one or more Onion Domain Names in a Certificate.

本附錄定義在憑證中包含一個或多個 Onion 網域名稱（Onion Domain Name）時所允許採用的驗證程序。

  1. The ADN MUST contain at least two Domain Labels, where the rightmost Domain Label is “onion”, and the Domain Label immediately preceding the rightmost “onion” Domain Label is a valid Version 3 Onion Address, as defined in Section 6 of the Tor Rendezvous Specification - Version 3 located at https://spec.torproject.org/rend-spec-v3.
  1. 經授權網域名稱（Authorization Domain Name，ADN）應（MUST）包含至少兩個網域標籤（Domain Label），其中最右側的網域標籤為「onion」，且緊鄰該「onion」網域標籤左側的網域標籤應為有效的第 3 版 Onion 位址（Version 3 Onion Address），其定義見 Tor Rendezvous 規範－第 3 版 第 6 節。
  1. The CA MUST verify the Applicant’s control over the ADN using at least one of the methods listed below:

    1. (a) The CA MAY verify the Applicant’s control over the ADN by using any method from Section 3.2.2.4 that says “This method allows Onion Domain Name issuance”, with this modification:

      When these methods are used to verify the Applicant’s control over an Onion Domain Name, the CA MUST use Tor protocol to establish a connection to the ADN. The CA MUST NOT delegate or rely on a third-party to establish the connection, such as by using Tor2Web.

      Note: This section does not override or supersede any provisions specified within the respective methods. The CA MUST only use a method if it is still permitted within that section.

  1. CA 應（MUST）使用下列至少一種方法驗證申請者對經授權網域名稱（ADN）的控管權：

    1. （a） CA 得（MAY）使用第 3.2.2.4 節中任何載明「此方法允許簽發 Onion 網域名稱」的方法（指第 3.2.2.4 節表格中 Onion 欄位標示「✔」的方法），驗證申請者對經授權網域名稱（ADN）的控管權，但須做以下調整：

      使用上述方法驗證申請者對 Onion 網域名稱的控管權時，CA 應（MUST）使用 Tor 協定建立與經授權網域名稱（ADN）的連線。CA 不得（MUST NOT）委託第三方建立該連線，亦不得（MUST NOT）依賴第三方所建立的連線，例如使用 Tor2Web。

      注意：本節不凌駕或取代各驗證方法本身所規定的任何內容。CA 應（MUST）僅在該方法於其所屬章節中仍獲准使用時使用該方法。

    1. (b) The CA MAY verify the Applicant’s control over the .onion service corresponding to the ADN by having the Applicant provide a Certificate Request signed using the .onion service’s private key if the Attributes section of the certificationRequestInfo contains:

      • (i) A caSigningNonce attribute that contains a Random Value that is generated by the CA; and
      • (ii) An applicantSigningNonce attribute that contains a single value. The CA MUST recommend to Applicants that the applicantSigningNonce value should contain at least 64 bits of entropy.

      The signing nonce attributes have the following format:

      ASN.1
      cabf OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) international-organizations(23) ca-browser-forum(140) }

caSigningNonce ATTRIBUTE ::= {
   WITH SYNTAX              OCTET STRING
   EQUALITY MATCHING RULE   octetStringMatch
   SINGLE VALUE             TRUE
   ID                       { cabf-caSigningNonce }
}

cabf-caSigningNonce OBJECT IDENTIFIER ::= { cabf 41 }

applicantSigningNonce ATTRIBUTE ::= {
   WITH SYNTAX              OCTET STRING
   EQUALITY MATCHING RULE   octetStringMatch
   SINGLE VALUE             TRUE
   ID                       { cabf-applicantSigningNonce }
}

cabf-applicantSigningNonce OBJECT IDENTIFIER ::= { cabf 42 }

      The Random Value SHALL remain valid for use in a confirming response for no more than 30 days from its creation. The CPS MAY specify a shorter validity period for Random Values.

    1. （b） 若 certificationRequestInfo 的 Attributes 區段包含下列內容，CA 得（MAY）要求申請者提供以 .onion 服務私密金鑰（private key）簽章的憑證請求（Certificate Request），以驗證申請者對經授權網域名稱（ADN）所對應之 .onion 服務的控管權：

      • （i） caSigningNonce 屬性，其中包含由 CA 產生的隨機值（Random Value）；及
      • （ii） applicantSigningNonce 屬性，其中包含單一值。CA 應（MUST）向申請者建議，applicantSigningNonce 值宜包含至少 64 位元之亂度（entropy，資訊熵）。

      簽章 nonce（signing nonce）屬性的格式如下：

      ASN.1
      cabf OBJECT IDENTIFIER ::= { joint-iso-itu-t(2) international-organizations(23) ca-browser-forum(140) }

caSigningNonce ATTRIBUTE ::= {
   WITH SYNTAX              OCTET STRING
   EQUALITY MATCHING RULE   octetStringMatch
   SINGLE VALUE             TRUE
   ID                       { cabf-caSigningNonce }
}

cabf-caSigningNonce OBJECT IDENTIFIER ::= { cabf 41 }

applicantSigningNonce ATTRIBUTE ::= {
   WITH SYNTAX              OCTET STRING
   EQUALITY MATCHING RULE   octetStringMatch
   SINGLE VALUE             TRUE
   ID                       { cabf-applicantSigningNonce }
}

cabf-applicantSigningNonce OBJECT IDENTIFIER ::= { cabf 42 }

      隨機值自建立之日起，用於確認回覆的有效期限應（SHALL）不超過 30 日。憑證實務作業基準（Certification Practice Statement，CPS）得（MAY）規定更短的隨機值有效期限。

  1. When a Certificate includes an Onion Domain Name, the Domain Name shall not be considered an Internal Name provided that the Certificate was issued in compliance with this Appendix B.
  1. 若憑證中包含 Onion 網域名稱，且該憑證係依本文件附錄 B 規定所簽發，則該網域名稱不視為內部名稱（Internal Name）。