Recent from talks
DNS Certification Authority Authorization
Knowledge base stats:
Talk channels stats:
Members stats:
DNS Certification Authority Authorization
DNS Certification Authority Authorization (CAA) is an Internet security policy mechanism for domain name registrants to indicate to certificate authorities whether they are authorized to issue digital certificates for a particular domain name. Registrants publish a "CAA" Domain Name System (DNS) resource record which compliant certificate authorities check for before issuing digital certificates.
CAA was drafted by computer scientists Phillip Hallam-Baker and Rob Stradling in response to increasing concerns about the security of publicly trusted certificate authorities. It is an Internet Engineering Task Force (IETF) proposed standard.
A series of incorrectly issued certificates from 2001 onwards damaged trust in publicly trusted certificate authorities, and accelerated work on various security mechanisms, including Certificate Transparency to track misissuance, HTTP Public Key Pinning and DANE to block misissued certificates on the client side, and CAA to block misissuance on the certificate authority side.
The first draft of CAA was written by Phillip Hallam-Baker and Rob Stradling, and submitted as an IETF Internet Draft in October 2010. This was progressively improved by the PKIX Working Group, and approved by the IESG as RFC 6844, a Proposed Standard, in January 2013. CA/Browser Forum discussion began shortly afterward, and in March 2017 they voted in favor of making CAA implementation mandatory for all certificate authorities by September 2017. At least one certificate authority, Comodo, failed to implement CAA before the deadline. A 2017 study by the Technical University of Munich found many instances where certificate authorities failed to correctly implement some part of the standard.
In September 2017, Jacob Hoffman-Andrews submitted an Internet Draft intended to simplify the CAA standard. This was improved by the LAMPS Working Group, and approved as RFC 8659, a Proposed Standard, in November 2019.
As of June 2024[update], Qualys reports that only 15.4% of the 150,000 most popular TLS-supporting websites use CAA records.
Certificate authorities implementing CAA perform a DNS lookup for CAA resource records, and if any are found, ensure that the authority is listed as an authorized party in at least one of the CAA records before issuing a digital certificate. Each CAA resource record consists of the following components:
The lack of any CAA records authorizes normal unrestricted issuance, and the presence of a single issue tag without a specific issuer domain name disallows all issuance.
Hub AI
DNS Certification Authority Authorization AI simulator
(@DNS Certification Authority Authorization_simulator)
DNS Certification Authority Authorization
DNS Certification Authority Authorization (CAA) is an Internet security policy mechanism for domain name registrants to indicate to certificate authorities whether they are authorized to issue digital certificates for a particular domain name. Registrants publish a "CAA" Domain Name System (DNS) resource record which compliant certificate authorities check for before issuing digital certificates.
CAA was drafted by computer scientists Phillip Hallam-Baker and Rob Stradling in response to increasing concerns about the security of publicly trusted certificate authorities. It is an Internet Engineering Task Force (IETF) proposed standard.
A series of incorrectly issued certificates from 2001 onwards damaged trust in publicly trusted certificate authorities, and accelerated work on various security mechanisms, including Certificate Transparency to track misissuance, HTTP Public Key Pinning and DANE to block misissued certificates on the client side, and CAA to block misissuance on the certificate authority side.
The first draft of CAA was written by Phillip Hallam-Baker and Rob Stradling, and submitted as an IETF Internet Draft in October 2010. This was progressively improved by the PKIX Working Group, and approved by the IESG as RFC 6844, a Proposed Standard, in January 2013. CA/Browser Forum discussion began shortly afterward, and in March 2017 they voted in favor of making CAA implementation mandatory for all certificate authorities by September 2017. At least one certificate authority, Comodo, failed to implement CAA before the deadline. A 2017 study by the Technical University of Munich found many instances where certificate authorities failed to correctly implement some part of the standard.
In September 2017, Jacob Hoffman-Andrews submitted an Internet Draft intended to simplify the CAA standard. This was improved by the LAMPS Working Group, and approved as RFC 8659, a Proposed Standard, in November 2019.
As of June 2024[update], Qualys reports that only 15.4% of the 150,000 most popular TLS-supporting websites use CAA records.
Certificate authorities implementing CAA perform a DNS lookup for CAA resource records, and if any are found, ensure that the authority is listed as an authorized party in at least one of the CAA records before issuing a digital certificate. Each CAA resource record consists of the following components:
The lack of any CAA records authorizes normal unrestricted issuance, and the presence of a single issue tag without a specific issuer domain name disallows all issuance.