Re: [lamps] CAA tags

[Jacob Hoffman-Andrews <[e-mail]>]

I'm following up your the related validation@cabforum thread at
https://cabforum.org/pipermail/validation/2017-December/000686.html,
hoping to merge the streams a little bit. :-)

On 12/18/2017 11:10 AM, Tim Hollebeek via Validation wrote:
> I personally find OIDs very hard for non-technical users to grasp.

This is a good point, although most users should be using a CAA record
generator, which can help with this.

> readable text labels, like Validation=Phone?

My issue with validation=phone is that it is not precise enough; there's
one version of validation by phone defined in the BRs today, but what if
that changes significantly? One could solve this by defining a versioned
validation method, e.g. validation=phone-01, with an IANA registry to
register new ones as requirements change.

However, there does seem to be some interest in embedding information
about validation methods in certificates. It would be nice if there was
a correspondence between the namespace used in CAA and the one used in
certificates.

> I think account and account-uri are complimentary approaches.  I agree
> that CAs need the freedom to put whatever they want on the right hand
> side of these, and many CAs have existing customer identification
> schemes that are not URIs, so the account-uri field cannot be used.

It's easy to define a URI mapping for an existing account identifier.
For instance, if customers have a numeric id 123456, the CA can specify
that the corresponding account-uri is
https://ca.example.net/accounts/123456. There's no requirement that
account-uris are fetchable.

It seems inefficient to define the same mechanism under two different
names in two different places (account vs account-uri), and I think is
likely to lead to user error.