3 ms·
Why would they? The idea of CAA is to help the domain owner, to prevent malicious issued certificates, to have a documented, open, visible way do identify which
by okket 10y ago
Why would they? The idea of CAA is to help the domain owner, to prevent malicious issued certificates, to have a documented, open, visible way do identify which CA is authorised to issue a certificate. So, if you doubt what you see is legitimate, you have a way to check (also, when combined with DNSSEC, it is quite hard to forge/spoof).
Even without DNSSEC, every little bit of additional validation counts IMHO. You could e.g. trace sudden changes in CAA records and get very suspicious...
- tptacek 10y agoIt's quite hard to forge or spoof to anyone except: * The world governments that control the TLDs and can thus override DNSSEC policy by fiat. * Any attacker between the CA's resolver and the DNS server, since DNSSEC only protects transations between DNS servers, not between clients and servers.
- mnordhoff 10y agoI would hope CAs run their own DNSSEC validating resolvers, and they don't just plug "nameserver 8.8.8.8" into resolv.conf.