4 ms·
So only CAs check this, not browsers? Surely the problem this sort of thing is meant to address is rogue CAs who are already behaving badly.
by davidgerard 10y ago
So only CAs check this, not browsers?
Surely the problem this sort of thing is meant to address is rogue CAs who are already behaving badly.
- pfg 10y agoThat's correct. Browsers offer other mechanisms like HPKP to mitigate attacks through rogue CAs. Active CAA checks by browsers would either be soft-fail like OCSP (i.e. useless in the face of an active adversary who could block the request or spoof the response) or cause a lot of unnecessary warnings because of failed requests. You'd also have to force every site on earth to create a CAA record if you want it to be hard-fail. That's going to be impossible.
- tialaramex 10y agoNot really, no. CAA addresses the problem where you'd like to actively tell a trustworthy CA not to issue for your names. The Facebook incident I've mentioned further up is a good example.