3 ms·
Theoretically, a client could also query the record and check it against the certificate presented. That would basically be the same as a DANE CA constraint. I
by crote 7y ago
Theoretically, a client could also query the record and check it against the certificate presented. That would basically be the same as a DANE CA constraint.
I'm not aware of anyone actually doing this, though. Certificate Transparency requirements are probably enough to prevent any CA from attempting to cheat with CAA.
- tialaramex 7y agoDon't do this. CAA is not "This is the list of CAs that are trustworthy for this domain". CAA is "This is the list of CAs that can issue for this domain right at this precise moment". If you aren't a CA you should only be looking at CAA either to debug a weird problem, out of curiosity or for some research purpose. Do not use it to make security decisions if you are not a CA.