Consider forbidding countryName in DV profile

[aarongable]

Forked from #457

It is surprising that the countryName field is permitted in DV certificates. The name "Domain Validated" indicates that the validated information is the domain, so the inclusion of other validated information (which must be validated using methods more common to OV/IV/EV certificates) is a surprise.

In addition, I believe that the inclusion of the countryName field serves no real purpose in DV certs. It is not displayed by relying parties, and the information it carries is redundant at best and misleading at worst. Per 3.2.2.3, a countryName can be validated in four ways:

1. by IP geolocation -- this is potentially misleading, and should be disallowed
2. by ccTLD -- this is redundant
3. by Registrar -- this is effectively a subset of (4) below, since a registrar is a Reliable Data Source
4. by one of the Organization Validation methods -- in which case you should just be issuing an OV cert, not a DV cert

Finally, almost no DV certs include a countryName: this censys query shows less than 100 currently-valid trusted DV certs with a countryName. Forbidding this practice would have almost no effect on the webpki, but would simplify the BRs profiles and reduce confusion.

As such, I think we should consider forbidding inclusion of countryName in DV certs.

[github-actions]

This issue was created based on:

• TLS BR Version 2.2.6
• EVG Version 2.0.2

[ONO-Fumiaki]

As such, I think we should consider forbidding inclusion of countryName in DV certs.

I agree with the conclusion stated above.
Although countryName is marked as MAY in Section 7.1.2.7.2, its inclusion explicitly requires verification under Section 3.2.2.3.
In practice, Domain Validation does not perform such subject identity verification.
This makes the presence of countryName a structural source of Baseline Requirements violations.
Prohibiting countryName in DV would reduce this risk by design.
Reflecting this change in linting tools would further lower the probability of misissuance.

Best regards,

ONO Fumiaki / 大野 文彰
(Japanese name order: family name first, in uppercase)
SECOM Trust Systems CO., LTD.