Re: [lamps] CAA records on CNAMEs

We did not like using something like _caa.example.com ?

I mean we have an RFC and an IANA registry all set up to handle the
underscore name
(well almost https://tools.ietf.org/html/draft-ietf-dnsop-attrleaf-16)

We've been burned on CAA records for specific FQDNs which are CNAMEs.

Tim

On Sun, Mar 17, 2019 at 11:03 AM Ilari Liusvaara <ilariliusvaara@welho.com>
wrote:

> On Sat, Mar 16, 2019 at 06:32:26PM -0400, Jan Schaumann wrote:
> >
> > The "easiest" solution would be to allow CAA records on CNAMEs.  This
> > (currently) violates RFC1912, Section 2.4. But per RFC2181, section
> > 10.1, we already allow e.g. SIG, NXT, and KEY RRs on CNAMEs; would it
> > make sense to allow CAA on CNAMEs as well?
>
> Unfortunately that would break DNS. There are few exceptions to
> "nothing alongside CNAME" rule, but that is because the RRtypes
> involved are magic DNSSEC ones.
>
> Trying to stick anything else alongside CNAME leads to horrible
> failure rates. That is not some servers fail, but almost all servers
> fail. E.g., see. CNAME@apex (SOA and NS).
>
> > An alternative solution was suggested in the slides noted above: change
> > the CAA resolution algorithm to first attempt a _prefix on which I can
> > set an override (i.e., '_prefix.someapp.example.com IN CAA issue
> > "letsencrypt.org"').  This proposal was not reflected in
> > https://datatracker.ietf.org/doc/draft-ietf-lamps-rfc6844bis/, however,
> > so I assume there was discussion that concluded this to be undesirable?
>
> That lookup happens just on the full name, right after lookup on the
> name itself, right? I.e., not on any tree-climbed names.
>
> > A third possibility might be to add another 'override' tag to the CAA
> > definition, e.g.:
> >
> > example.com CAA 0 issue "digicert.com"
> > example.com CAA 0 override "someapp.example.com issue:letsencrypt.org"
> >
> > would mean that Digicert can issue certs for anything under example.com
> > with the exception of 'someapp.example.com', for which only Let's
> > Encrypt can issue a cert.
>
> One would presumably want to flag that as critical.
>
> And are overrides recursive or not? Based on description it looked that
> they require exact match.
>
> And how is the name represented? DNS can present all sorts of really
> wonky names, including ones containing spaces or dots. I do not think
> public CAs are allowed to issue for such names tho.
>
> > I'm seeking input on whether the workgroup would consider any of these
> > options or otherwise would revive the discussion around the need to find
> > a way to set CAA records on a CNAME separate from the parent label.
>
>
> -Ilari
>
> _______________________________________________
> Spasm mailing list
> Spasm@ietf.org
> https://www.ietf.org/mailman/listinfo/spasm
>