Subject: [pkix] Fix to CAA

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 21 Aug 2012 10:48:35 -0400

I have already removed the language relating to public delegation
points from the draft so that in the new scheme the CA MUST check for
CAA records from the leaf node right up to the TLD.

ie if there is no CAA record in example.com, then a CAA record in .com
will apply.

This change makes CAA consistent with the DNS architecture but makes
the 'abusive CAA record' problem more severe, particularly if VeriSign
was still a CA in addition to being the registry of .com. I propose to
address this issue by changing the language of section 3 as follows:

Current:

        Before issuing a certificate, a compliant CA MUST check for publication
        of a relevant CAA Resource Record(s).  If such record(s) are published,
        the  requested certificate MUST consistent with them if it is
to be issued.
        If the certificate requested is not consistent with the
relevant CAA RRs,
        the CA MUST NOT issue the certificate.

New:

        Before issuing a certificate, a compliant CA MUST check for publication
        of an applicable CAA Resource Record set. If such a record set
exists, a CA
        MUST NOT issue a certificate unless the CA determines that either
        (1) the certificate request is consistent with the applicable
CAA Resource
        Record set or (2) that an exception specified in the
applicable Certificate
        Policy or Certification Practices Statement Applies.

Note that adoption of CAA is an option for the CA. So if they decide
to implement, they can decide to implement with exceptions and that is
OK, provided that the exceptions are documented and in the case of a
public CA, that they are published.

The practical effect of these changes is that they cancel each other
out. The CA implementing CAA now has to climb the whole DNS tree each
and every time regardless of what their policy says. They can however
publish a policy that states 'we ignore CAA records in TLDs' or 'we
ignore CAA records in domains listed in the CABForum Well Known
issuing points list' or whatever.

A CA could even point to a list on Wikipedia if they felt like, though
I would think they would find it rather difficult to get Microsoft,
Google, Mozilla and co to accept their CPS when they are trying to get
their anchor embedded.

In effect the policy loophole required because the world is
complicated moves from the technical specification back into the
policy world where it belongs.

-- 
Website: http://hallambaker.com/

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 21 Aug 2012 09:02:03 -0700

> CAA records from the leaf node right up to the TLD.

Just checking: this is in a draft we have not seen, correct?

> was still a CA in addition to being the registry of .com.

No need to pick on your previous employer: there are other CAs with "close ties" to other TLDs.

> I propose to

It doesn't look like you define "applicable"; I propose that you continue to use "relevant". Your addition of the two options seems fine, and appropriate for cases such as a CA whose CP or CPS says "we'll issue certs even if we find a CAA record in the TLD".

--Paul Hoffman

---

From: Andrew Sullivan <[email-masked]>
Date: Tue, 21 Aug 2012 12:19:56 -0400

> issuing points list' or whatever.

Where "whatever" includes, "We ignore CAA records at any owner name
except the owner name actually included in the request," or, "We
ignore CAA records at any owner name except the owner name included in
the request, or the direct parent," right?  It would appear to do.

Best,

A

-- 
Andrew Sullivan
[email-masked]

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 21 Aug 2012 09:25:30 -0700

> the request, or the direct parent," right?  It would appear to do.

Yes. Such is the nature of CPs and CPSs, the policy underpinnings of our PKI.

--Paul Hoffman

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 21 Aug 2012 12:50:19 -0400

> Just checking: this is in a draft we have not seen, correct?

Correct, I am working on it right now and bringing up sections for
discussion so that hopefully -12 is the last one you need to read.

> It doesn't look like you define "applicable"; I propose that you continue to use "relevant". Your addition of the two options seems fine, and appropriate for cases such as a CA whose CP or CPS says…

OK, relevant.