Re: [Spasm] CAA erratum 4515

[Ryan Sleevi <[e-mail]>]

On Sun, Mar 12, 2017 at 11:43 AM, Phillip Hallam-Baker <
[e-mail]> wrote:

> If people want an escape hole 'anyone can issue' in CAA, I would rather do
> it by defining generic domains:
>
> ev.cabforum.org
> dv.cabforum.org
>
> That avoids the need to define new tags or update processing code. They
> are simply domains that any WebTrust or ETSI audited CA issuing to those
> requirements can issue.
>

I think there are several flaws with this argument:

- It's only applicable to set the of CAs bound by such a profile; that is,
a CA who is not WebTrust audited could just as easily issue such a
certificate without 'violating' either the letter or spirit of CAA, so it's
pointless to try to describe policy in that way
- The idea of introducing audits into the technical description is flawed,
in as much as audits are post-facto evaluations of operations. So it
wouldn't be a violation - of CAA or program requirements - for a CA with an
EV audit to issue such a certificate as DV if their CP/CPS dictated - it'd
only be post-facto misissuance.
- It still effectively limits the ability to express, for a given CA, the
desired policies of issuance. One organizations 'EV' can be another
organizations QCP+.

Let's keep to a simple principle - of simply saying 'any' - and leave
distinctions about certificate policies relevant to the set of CAs being
interacted with (e.g. as tags). That's the only way that really makes a
defensible - and auditable - security boundary, without relying on external
evaluations (whether or not a given CA is 'trusted' for EV, whether or not
a given CA is audited for EV, etc)