Subject: [pkix] Update to CAA spec

From: Phillip Hallam-Baker <[email-masked]>
Date: Thu, 23 Aug 2012 17:12:35 -0400

http://www.ietf.org/id/draft-ietf-pkix-caa-12.txt

I have made what I hope is most of the edits required in response to
the IESG, APPs and DNS reviews.

The main substantive change here is that the old discovery algorithm
is completely gone and it is replaced with a functional specification
which I hope is more precise and easier to read.

In the process of doing that I removed the language referring to the
issuer authorization set and replaced it with 'relevant CAA record
set' which I hope is easier to follow.

One issue that might be argued over is which order a CA should follow
aliases and search up the chain. As the draft stands is says, follow
the alias first and if that is empty then look in the domain above. I
suspect that it makes no difference which is done provided everyone
does the same thing.

-- 
Website: http://hallambaker.com/

---

From: Andrew Sullivan <[email-masked]>
Date: Fri, 24 Aug 2012 08:42:48 -0400

> suspect that it makes no difference which is done provided everyone

I haven't read the draft yet (I will), but in this matter, if that's
what the draft says it is certainly the only correct thing to say.

As a straightforward DNS matter, the alias _will_ be chased first.  So
it wouldn't be possible to climb the tree first, because when you run
into a CNAME (or a DNAME at the parent), you start substitution.

Best,

A

-- 
Andrew Sullivan
[email-masked]