Re: [Spasm] CAA erratum 4515

[Jacob Hoffman-Andrews <[e-mail]>]

On 03/09/2017 12:35 PM, Ryan Sleevi wrote:
> I want to be careful here restricting it to the notion of "CDNs",
I'm using CDN as a shorthand for "hosting provider or CDN." In the
Twitter example, the other stakeholders are the marketing department and
the contractor who develops the web content, neither of whom have CNAMEs
in the mix. Is there another entity type I'm missing?

>     *Hole punching and the includeSubDomains problem*
>
> As you noted elsewhere, to effectively get this scenario, the operator
> of superbowl2017.twitter.com <http://superbowl2017.twitter.com> (which
> we'll call example.com <http://example.com>) would need to set up the
> destination of CNAME in such a way as to be able to appropriately
> express the per-customer policy (if Twitter handles certificate
> provisioning) - that is, superbowl2017.twitter.example.com
> <http://superbowl2017.twitter.example.com> -  or, as you noted, would
> need to effectively set the CAA record as a 'wildcard' / for every
> customer.
I don't understand why example.com would need to set a per-customer
policy. If terrier.dog handles certificates for their customers, they
would do so with a limited set of CAs, and could set that as policy on
their domain names. If a specified customer like www.staffie.dog needs a
different policy, they can set it on their own hostname:

www.staffie.dog.        CAA 0 issue "sad-hacker-totally-real-ca.net"


I don't think trampolining is necessary to make this work.

If terrier.dog doesn't handle certificates, e.g., if they expect
customers to bring their own cert from any CA, then they can't
reasonably set a blanket policy for all their customers. In that
situation, I think it would similarly be up to the customer to set a CAA
policy on their own hostname if they wanted one, since the customer is
the one with the CA relationship.