The Certificate Authority Authorization (CAA) DNS record type includes an issue
parameter (also issuewild
) that designates an identifier for a Certificate Authority allowed to issue certificates for your domain. That's ok, but it's a little vague.
When setting the value in your own CAA records, how are you supposed to find out what the exact value should be for your CA(s)? In the case of letsencrypt, they provide a document here that mentions that their issue identifier is letsencrypt.org
, and that it's also documented in their Certification Practice Statement section 4.2.1. If I inspect the certificate, I can see various fields in it, however, none match this string exactly, though there are some that contain it. That doesn't seem like a rigorous or reliable way of ensuring that the CA matches what's in the CAA record - for example what's stopping it being matched by letsencrypt.org.evilcorp.com
?
This is all workable from a human perspective, but not very machine readable, and is unique to this CA.
I also have certs from Comodo, and I've found various non-authoritative sources saying that their CAA issue id is comodoca.com
(and others saying it's comodo.com
), but I've not found an official doc like letsencrypt have for that. The comodoca.com
string does appear in some fields of my cert, but not in a context I'd expect it to be found reliably - for example the issuer name is COMODO ECC Domain Validation Secure Server CA (COMODO CA Limited from GB)
, the CRL is http://crl.comodoca.com/COMODOECCDomainValidationSecureServerCA.crl
and the OCSP URI is http://ocsp.comodoca.com
.
SSLMate have a CAA record generator and it includes a list of CAs and their issuer IDs - but where was that info obtained from?
Now consider the validation case - given a cert and one or more CAA issuer IDs, what elements in the cert should we expect to match the CAA issuer exactly? Or is that info obtained from some other service like a CT log?
So, in short, where should CAA issuer IDs be obtained from and how should they be validated reliably?
issue
field must contain a valid domain name. If you matchletsencrypt.org
toletsencrypt.org.example.com
, you are doing it wrong, this is not a match.