Re: [TLS] [pkix] Proposing CAA as PKIX Working Group Item

[Martin Rex <[e-mail]>]

Peter Gutmann wrote:
> 
> Yoav Nir <[e-mail]> writes:
> > 
> > CAA works if all root CAs and affiliates follow it. That's hundreds or
> > thousands of entities. Any one of them that fails to comply might ignore
> > the CAA record.
> 
> That was my problem with it, any CA (and/or RA) that's already diligent
> about cert issuance doesn't need CAA, and any one that isn't won't use
> it anyway, so it doesn't address any existing problem.

You're looking at CAA from the wrong angle.

CAA is _not_ for the RP, i.e. not for _you_ (and me, and most others ...)
It is only another means for a CA to detect attempts to subvert one of
its RAs, so it's primary purpose is CYA for large commercial CAs.

So a Server admin that has a CAA published is not really using it to
_protect_ clients.  It may reduce the likelyhood to get certs
mis-issued, though, and is therefore well in the ballpark of
what businesses are doing to protect against fraud (not protecting
against it, just make it remain under a certain fraud loss threshold).


-Martin