3 ms·
> This is to protect against malicious operators from getting CAs to give them certificates without authorization of the domain owner. The reason this is necess
by discreditable 10y ago
> This is to protect against malicious operators from getting CAs to give them certificates without authorization of the domain owner. The reason this is necessary is because the method that CAs use to validate that they're issuing the certificate to the right person is not standardized, and so you end up with a bunch of potential ways that an operator could fraudulently get a certificate that are hard to stop. I know in the past, some CAs would issue to certificates to anyone with root@, admin@, or any one of a list of privileged email addresses. Do you want email admins to be able to create whatever certificates they want for your domain? No.
I don't see how CAA protects against this. If you're using CAA, presumably your email admin could just request a certificate from one of the whitelisted CAs. The only saving factor is if your whitelisted CAs don't support email-based verification.
- klodolph 10y agoYou already have a relationship with the whitelisted CAs and they know who the correct points of contact are.
- jpalomaki 10y agoThe standard also makes it possible to add CA specific limitations. The RFC shows as example how you could setup the record do that CA will only serve requests for specific customer account. Since there's quite much competition on the field, I would assume CAs will be eager to implement these kind of value add services.
- tialaramex 10y agoThere is at least one CA that simply doesn't offer DV. So if you happen to agree with them that DV is worthless (for the record I do not), or at least that it's never appropriate for your business, then setting CAA to require that CA means nobody will be using some scheme to get "legitimate" DV certificates for your domain.