Re: [lamps] Ambiguities in RFC 6844 regarding CAA resource record sets with no "issue" property tags

[Jacob Hoffman-Andrews <[e-mail]>]

On 03/27/2018 07:27 AM, Corey Bonnell wrote:
> As for my original erratum text not specifying "issuewild", that is 
> because section 5.3 (5.3.  CAA issuewild Property) specifies that "The 
> issuewild property has the same syntax and semantics as the issue 
> property except that issuewild properties only grant authorization to 
> issue certificates that specify a wildcard domain". Given that 
> issuewild property tags have the same semantics as issue property 
> tags, the addition of my original erratum text (in section 5.2, which 
> defines issue property tag semantics) will also address the case of a 
> resource record set not containing issue property tags and not 
> containing issuewild property tags (only in the case of wildcard 
> domain names, since issuewild property tags are otherwise ignored as 
> per section 5.3).
>
> If you think that's too vague and it's better to explicitly mention 
> the lack of issuewild tags, we should qualify the language a bit to 
> say "A non-empty CAA record set that contains no issue property tags 
> (and also does not contain any issuewild property tags when performing 
> issue restriction processing for a wildcard domain) is authorization 
> to any certificate issuer to issue for the corresponding domain, 
> provided that no records in the CAA record set otherwise prohibit 
> issuance." Otherwise, it is unclear how to handle the case of a 
> non-empty CAA record set for a non-wildcard domain that does not 
> contain an issue property tag but contains one or more issuewild 
> property tags.
>
I updated my PR to reflect this feedback. I decided to go with "more 
verbose is better," so now the section that describes what to do when 
there is no "issue" tag specifically excludes wildcard domains. And I 
added to the "issuewild" section language that say both "issue" and 
"issuewild" must be absent to be considered authorization to issue:

https://github.com/jsha/caa-simplification/pull/1/commits/65a5665c6cc6db6e90c8b43fed4ae0bf5e8f83ee

I'll merge this shortly to produce a new draft, but am happy to keep 
discussing the fine details. :-)