Re: [Spasm] CAA erratum 4515

[Ryan Sleevi <[e-mail]>]

On Sun, Mar 12, 2017 at 11:06 AM, Jacob Hoffman-Andrews <[e-mail]>
wrote:
>
> Looking at the types of policy I described earlier:
>
> > 1. Policy set by user-facing domain owner for their own hostnames.
> > 2. Blanket policy set by CDN for hostnames they operate on their
> customers' behalf.
> > 3. Policy set by CDN for their own hostnames, which share the same
> base domain as the CNAME targets used in (2).
>
> In the tree-climbing world, given the above restriction on CNAMEs
> coexisting, it would be impossible for a CDN to express "(3) without
> (2)". Worse, if some CDN did express (3), it would be impossible for
> their customers to opt out by setting CAA records on their own domains.
> This would effectively bar CDNs from expressing (3) in the tree-climbing
> world.


> I think this is sufficient to say that tree climbing is undesirable.
> What do other folks think?


I think you're correct in that, in the absence of some form of trampoline -
and an 'any' policy - it can't be expressed.

However, am I mistaken in thinking that with those two - it could be? I
just want to make sure we know where the differences lie. Removing tree
climbing is arguably a substantive change to the specification, and would
likely require a document update. An 'any' expression and trampoline become
operational guidance, but don't require changing the specification.

Not to suggest one is more or less desirable than the other, but making
sure we've got a fully articulated set of guidance for "How you can
configure these cases with tree-climbing" and "How you can configure cases
without tree-climbing", and then evaluate their relative costs (to site
operators, to CAs, and 'process' wise). Does that sound reasonable?