The Certificate Authority Authorization (CAA) DNS record type includes an
issue parameter (also
issuewild) that designates an identifier for a Certificate Authority allowed to issue certificates for your domain. That's ok, but it's a little vague.
When setting the value in your own CAA records, how are you supposed to find out what the exact value should be for your CA(s)? In the case of letsencrypt, they provide a document here that mentions that their issue identifier is
letsencrypt.org, and that it's also documented in their Certification Practice Statement section 4.2.1. If I inspect the certificate, I can see various fields in it, however, none match this string exactly, though there are some that contain it. That doesn't seem like a rigorous or reliable way of ensuring that the CA matches what's in the CAA record - for example what's stopping it being matched by
This is all workable from a human perspective, but not very machine readable, and is unique to this CA.
I also have certs from Comodo, and I've found various non-authoritative sources saying that their CAA issue id is
comodoca.com (and others saying it's
comodo.com), but I've not found an official doc like letsencrypt have for that. The
comodoca.com string does appear in some fields of my cert, but not in a context I'd expect it to be found reliably - for example the issuer name is
COMODO ECC Domain Validation Secure Server CA (COMODO CA Limited from GB), the CRL is
http://crl.comodoca.com/COMODOECCDomainValidationSecureServerCA.crl and the OCSP URI is
SSLMate have a CAA record generator and it includes a list of CAs and their issuer IDs - but where was that info obtained from?
Now consider the validation case - given a cert and one or more CAA issuer IDs, what elements in the cert should we expect to match the CAA issuer exactly? Or is that info obtained from some other service like a CT log?
So, in short, where should CAA issuer IDs be obtained from and how should they be validated reliably?