Comment by itintheory
2 days ago
> One big problem with the CA system is that any CA - even the most incompetent - can sign certificates for any domain.
Is this not what CAA records were intended to solve? It seems like in practice they're only used by CAs to decide if they can sign a cert for a given domain, but it seems like a client could use it to determine if a server cert was from the correct CA.
CAA records are only checked by the CA at the point of issuance, not by the client later. If they did, there are problems to consider:
1. A domain would have to keep the CAA records for a CA in place to keep using the certificates from that CA, but that means continuing to authorise new issuance too. Right now, I can remove the `letsencrypt.org` value to stop them from issuing new certificates for me, but I can keep using any certificates I have until they expire.
2. The client would need to have support for this new DNS RR type.
3. The client would need a secure way to query DNS, which is not widespread.
1. Yeah, that's true. It'd need to be something akin to SPF where it gets validated and kept up to date. 2. Yep, you're right. CAA isn't the correct record type. 3. I'd guess that in the vast majority of cases where a TLS cert is used, DNS is also in use. In the case of an offline validation, you're also not able to check CRL, OCSP, etc. so there are already tradeoffs there. Oh, wrt to "secure" - I guess that's the gotcha. DoH would be chicken-and-egg... something like DNSSEC would be needed, though that may be an impossible prerequisite.
CAA records were never intended to be used by clients (Relying Parties), the RFC specifically prohibits them from using the CAA record to determine if the issuer was allowed to have issued the cert.
I infer from the wording around there and elsewhere in the RFC that this is mostly because someone could switch issuers but still serve valid certs from the prior issuer, and there's no way an RP would have a historical record of which CAA values were in effect when to be able to determine if the issuance was valid or not.
That makes sense. Seems like there could be a different record type, similar to SPF that could be used in this way though...