Re: [lamps] CAA processing for email addresses

some thoughts:

1. marking this record critical will make block TLS certificate for that 
domain unless they understand this. I think that is a footgun worth mention.

2. there are 'free to register' email domains. would it be acceptable to 
them to limit client's certificate choice?

for example, Google can set a issuemail record on gmail.com with a 
contracted CA and force user go get s/mime from that CA.

2022-12-01 오전 2:17에 Corey Bonnell 이(가) 쓴 글:
>
> Hello,
>
> Over the past several years, there have been discussions [1][2][3] on 
> extending CAA such that it can be used for domains to express 
> restrictions on the issuance of certificates for email addresses 
> (e.g., S/MIME certificates, etc.). With the recent passage of the 
> initial version of the CA/Browser Forum S/MIME Baseline Requirements, 
> there is a renewed interest in mandating that publicly trusted CAs 
> process CAA records prior to the issuance of S/MIME certificates in an 
> upcoming version of the requirements. In order to provide a full 
> specification for CAA processing for email addresses, I drafted an I-D 
> for a new CAA property tag: 
> https://www.ietf.org/archive/id/draft-bonnell-caa-issuemail-00.html. I 
> am hopeful that such a specification can be reviewed here such that 
> any update to the S/MIME Baseline Requirements that mandates CAA 
> processing can directly reference the specification.
>
> Given that CAA is a topic that is firmly within the scope of this WG, 
> I wanted to circulate the draft here and would appreciate feedback and 
> comments.
>
> Thanks,
>
> Corey
>
> [1] https://groups.google.com/g/mozilla.dev.security.policy/c/NIc2Nwa9Msg
>
> [2] https://github.com/mozilla/pkipolicy/issues/135
>
> [3] 
> https://lists.cabforum.org/pipermail/smcwg-public/2020-October/000040.html
>
>
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm