Re: [lamps] CAA records on CNAMEs

[Ilari Liusvaara <[e-mail]>]

On Sat, Mar 16, 2019 at 06:32:26PM -0400, Jan Schaumann wrote:
> 
> The "easiest" solution would be to allow CAA records on CNAMEs.  This
> (currently) violates RFC1912, Section 2.4. But per RFC2181, section
> 10.1, we already allow e.g. SIG, NXT, and KEY RRs on CNAMEs; would it
> make sense to allow CAA on CNAMEs as well?

Unfortunately that would break DNS. There are few exceptions to
"nothing alongside CNAME" rule, but that is because the RRtypes
involved are magic DNSSEC ones.

Trying to stick anything else alongside CNAME leads to horrible
failure rates. That is not some servers fail, but almost all servers
fail. E.g., see. CNAME@apex (SOA and NS).  

> An alternative solution was suggested in the slides noted above: change
> the CAA resolution algorithm to first attempt a _prefix on which I can
> set an override (i.e., '_prefix.someapp.example.com IN CAA issue
> "letsencrypt.org"').  This proposal was not reflected in
> https://datatracker.ietf.org/doc/draft-ietf-lamps-rfc6844bis/, however,
> so I assume there was discussion that concluded this to be undesirable?

That lookup happens just on the full name, right after lookup on the
name itself, right? I.e., not on any tree-climbed names.

> A third possibility might be to add another 'override' tag to the CAA
> definition, e.g.:
>
> example.com CAA 0 issue "digicert.com"
> example.com CAA 0 override "someapp.example.com issue:letsencrypt.org"
> 
> would mean that Digicert can issue certs for anything under example.com
> with the exception of 'someapp.example.com', for which only Let's
> Encrypt can issue a cert.

One would presumably want to flag that as critical.

And are overrides recursive or not? Based on description it looked that
they require exact match.

And how is the name represented? DNS can present all sorts of really
wonky names, including ones containing spaces or dots. I do not think
public CAs are allowed to issue for such names tho.

> I'm seeking input on whether the workgroup would consider any of these
> options or otherwise would revive the discussion around the need to find
> a way to set CAA records on a CNAME separate from the parent label.


-Ilari