Re: [Spasm] CAA erratum 4515

[Rob Stradling <[e-mail]>]

On 15/03/17 14:46, Ryan Sleevi wrote:
<snip>
>     Also, as a concrete example of the non-intuitiveness, Rob (one of
>     the CAA authors) mentioned on the CA/Browser Forum list that he has
>     had to double-check the lookup algorithm with Phill, his co-author.
>
>
> I don't know how well this as an argument works. It's been nearly four
> years since CAA was published before CAs got around to using it, nearly
> seven years since it was first proposed, and the algorithm went through
> several substantive revisions as part of the process :) I would say it's
> reasonable to expect the people most involved and invested in it to have
> a lot more mental state to sort through as to where "the process"
> finally ended up ;)
>
>
>     I've also been confused by the CAA lookup algorithm, as have my
>     coworkers. I can't speak for Rob, but for me a big part of the
>     confusion has been the fact that tree-climbing seems like an anomaly
>     in the DNS world.
>
>
> Perhaps in the DNS world, but it's SOP for the Certificate Authority
> world. Consider the act of validating using approved email addresses -
> or validating the 'registerable' domain. Both of these algorithms start
> with an FQDN and then climb the tree until they are able to establish an
> authortative link, and then everything below that tree is accepted as
> validated.

The DNS world is not my natural habitat.  ;-)

I don't think I had much additional mental state to sort through when I 
came to implement CAA for Comodo.  I read RFC6844 section 4, and then I 
re-read it numerous times, but I could not determine with certainty 
whether or not I should tree climb after following a CNAME.  So I sought 
clarification from Phill, since he was the primary author.

-- 
Rob Stradling
Senior Research & Development Scientist
COMODO - Creating Trust Online