Re: [Spasm] CAA erratum 4515

[Jacob Hoffman-Andrews <[e-mail]>]

On 03/10/2017 09:02 AM, Ryan Sleevi wrote:
> I'm also trying to stick to using domains reserved for purpose, rather
> than use staffie.dog and terrier.dog.
I chose these advisedly. Example.{com,net,org} are actively harmful for
reading comprehension, because their distinguishing parts are small and
come at the end rather than the beginning. Since this is a conversation,
not a normative document, I believe there's no requirement to use the
reserved domains. Do you disagree?

> - Self-Managed = The domain operator of example.com
> <http://example.com> handles certificate acquisition for
> www.example.com <http://www.example.com>
> - Externally-Managed = The domain operator of example.net
> <http://example.net> handles certificate acquisition for
> www.example.com <http://www.example.com>
Good terms, agreed.
> - Recursive = As currently specified
> - Non-Recursive = As Erratum 4515 proposes
Since we both care about terminology, I'm going to recommend we instead
use the RFC 6844 terms I used in my previous email: tree climbing vs
non-tree climbing. Recursive already has a technical meaning in RFC 1035
which differs from this one.
> - Trampoline = example.com <http://example.com> points their CNAME to
> a host at example.net <http://example.net> that is dedicated 'for
> them' (the 'staffie.example.net <http://staffie.example.net>' case)
+1.

> We end up with the following configurations:
These configurations are a little confusing, since you don't define
goals. I assume the goals in this example are:
 (a) Every domain and subdomain in the example is covered by a CAA
policy, and
 (b) Those CAA records are compatible with these policies:
    (1) the owner of the user-facing domain will only buy certs from a
certain CA
    (2) the owner of the CDN domain will only buy certs from another,
different CA.

Is that accurate? I'll adopt the CA names "user-facing.ca." and
"enterprise.ca", since both our example CA names implied goodness or
badness, which is not relevant to the discussion.

I'm going to introduce one more assumption: the CDN issues certificates
for their own internal subdomains, and wants a CAA policy for those.
This is necessary to explain why the CDN sets any CAA records at all in
the Self-managed case. And I think this is what's implied by your
examples - right?

I think it makes the most sense to start with two baseline configs:
trampoline'd and non-trampoline'd, and from there define what
*additional* CAA records are necessary in the various worlds of
Self-managed vs Externally managed, and tree climbing vs non-.

Trampoline'd config:

www.staffie.dog.        CNAME staffie.terrier.dog.
staffie.terrier.dog.    A 192.0.2.1


Non-trampoline'd config (all customers CNAME to the same www subdomain):

www.beagle.dog.        CNAME www.hound.dog.
www.hound.dog.         A 192.0.2.2


Self-managed, tree-climbing:

www.staffie.dog.        CAA 0 issue "user-facing.ca"
staffie.dog.            CAA 0 issue "user-facing.ca"
www.beagle.dog.         CAA 0 issue "user-facing.ca"
beagle.dog.             CAA 0 issue "user-facing.ca"
terrier.dog.            CAA 0 issue "enterprise.ca"
hound.dog.              CAA 0 issue "enterprise.ca"

Self-managed, non-tree-climbing:
staffie.dog.            CAA 0 issue "user-facing.ca"
beagle.dog.             CAA 0 issue "user-facing.ca"
terrier.dog.            CAA 0 issue "enterprise.ca"
hound.dog.              CAA 0 issue "enterprise.ca"

Externally-managed, tree-climbing:

staffie.dog.            CAA 0 issue "user-facing.ca"
beagle.dog.             CAA 0 issue "user-facing.ca"
terrier.dog.            CAA 0 issue "enterprise.ca"
hound.dog.              CAA 0 issue "enterprise.ca"

Externally-managed, non-tree-climbing:

staffie.dog.            CAA 0 issue "user-facing.ca"
beagle.dog.             CAA 0 issue "user-facing.ca"
staffie.terrier.dog.    CAA 0 issue "enterprise.ca"
terrier.dog.            CAA 0 issue "enterprise.ca"
www.hound.dog.          CAA 0 issue "enterprise.ca"
hound.dog.              CAA 0 issue "enterprise.ca"

Now, if we like, we can factor out the CAA records that appear in every
example: those for the base domains staffie.dog, beagle.dog,
terrier.dog, and hound.dog. That allows us to look at the differences
between the worlds more closely, and see what CAA records are required
beyond those:

*Reduced examples*

Self-managed, tree-climbing:

www.staffie.dog.        CAA 0 issue "user-facing.ca"
www.beagle.dog.         CAA 0 issue "user-facing.ca"

Self-managed, non-tree-climbing:
none

Externally-managed, tree-climbing:

none

Externally-managed, non-tree-climbing:

staffie.terrier.dog.    CAA 0 issue "enterprise.ca"
www.hound.dog.          CAA 0 issue "enterprise.ca"


*Mixed-management*

Complicating things further, we additionally need to consider
"Mixed-management," the use case that Patrick described, where CDN
certificates are externally managed, but owners of user-facing domains
also buy their own certificates for domains that are CDN-managed. I
think in practice, all "Externally-managed" arrangements are actually
"Mixed-management." Under the assumption that most owners of user-facing
domains are unwilling or unable to deploy their own CAA records
overriding CDN CAA records, this may make deployment of blanket CAA
policies by CDNs impractical, regardless of tree-climbing or
non-tree-climbing.