3 ms·
A CAA DNS record won't help much if the attacker can just go to the certificate issuer and request a valid SSL certificate because they own DNS. Plus can't they
by nodesocket 8y ago
A CAA DNS record won't help much if the attacker can just go to the certificate issuer and request a valid SSL certificate because they own DNS. Plus can't they just change the CAA DNS record?
- autocracy 8y agoIf you are using DNSSEC, hopefully the issuers are validating it.
- move-on-by 8y agoI'm not able to find any information on Let's Encrypt and DNSSEC validation. Anyone know if they validate it?
- tialaramex 8y agoYes, (last I checked at least) Let's Encrypt validates DNSSEC, this causes problem periodically for users who expected something to work but the DNSSEC setup is wrong and they never noticed before because nothing checked.
- rocqua 8y agoIf you have DNSSEC that protects against CAA spoofing, that should also protect against A-record spoofing. Unless we fail open on A records but closed on CAA records.