[lamps] CAA processing for email addresses

[Corey Bonnell <[e-mail]>]

Hello,

Over the past several years, there have been discussions [1][2][3] on
extending CAA such that it can be used for domains to express restrictions
on the issuance of certificates for email addresses (e.g., S/MIME
certificates, etc.). With the recent passage of the initial version of the
CA/Browser Forum S/MIME Baseline Requirements, there is a renewed interest
in mandating that publicly trusted CAs process CAA records prior to the
issuance of S/MIME certificates in an upcoming version of the requirements.
In order to provide a full specification for CAA processing for email
addresses, I drafted an I-D for a new CAA property tag:
https://www.ietf.org/archive/id/draft-bonnell-caa-issuemail-00.html. I am
hopeful that such a specification can be reviewed here such that any update
to the S/MIME Baseline Requirements that mandates CAA processing can
directly reference the specification.

 

Given that CAA is a topic that is firmly within the scope of this WG, I
wanted to circulate the draft here and would appreciate feedback and
comments.

 

Thanks,

Corey

 

[1] https://groups.google.com/g/mozilla.dev.security.policy/c/NIc2Nwa9Msg

[2] https://github.com/mozilla/pkipolicy/issues/135

[3]
https://lists.cabforum.org/pipermail/smcwg-public/2020-October/000040.html