Hacker News Reader

Comment by tallanvor | Hacker News Reader

There seem to be very little benefit to this new validation check. The CAs I've used have required you to prove you have control over the domain you want a certificate for (either by adding a DNS entry or by responding to an email sent to one of the defined contacts in the registry.

If someone can already create a new DNS entry for you, they can create their own CAA entry. If someone has compromised your registry account, they can always redirect DNS requests for your site to a new location.

View on HN

Appart from DNS many CAs do web or email based checks. And those had quite a few vulnerabilities in the past, e.g. in the extraction of whois records (via OCR...) [1] or through markup injection in the validation emails [2]. CAA can prevent misissuance in such cases.

Having an extra safety layer around these is definitely useful. It's not a super strong measurement like HPKP and CT, but still I think CAA is a useful extra security mechanism in the CA ecosystem.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=1311713 [2] https://thehackerblog.com/keeping-positive-obtaining-arbitra...

I think github.io is a good example of where this can be very useful. Users have a lot of control over the content of their pages, but it is undesirable to allow them to get a cert for username.github.io. Previously the only defense would be to block all files or content that could be used for domain validation or specific blacklisting by all CAs. Now GitHub can just say "no one can generate certs for this domain".

You have it backwards. The point of this is so that a CA does not issue a certificate to someone who does not have control of your DNS records. It's a fail safe.

Plus combining this with Certificate Transparency should allow for handling this in an automated fashion. A third party can validate CAs to ensure compliance.

  A third party can validate CAs to ensure compliance.

Domain owners can remove or change the CAA record after the certificate has been issued - so any third parties performing checking will have to be quick about it :)

Well you would want it to be quick anyway right? I don't want to know about a shady cert issuance next month, I'd want to know now!

Why would they? The idea of CAA is to help the domain owner, to prevent malicious issued certificates, to have a documented, open, visible way do identify which CA is authorised to issue a certificate. So, if you doubt what you see is legitimate, you have a way to check (also, when combined with DNSSEC, it is quite hard to forge/spoof).

Even without DNSSEC, every little bit of additional validation counts IMHO. You could e.g. trace sudden changes in CAA records and get very suspicious...

It's quite hard to forge or spoof to anyone except:

* The world governments that control the TLDs and can thus override DNSSEC policy by fiat.

* Any attacker between the CA's resolver and the DNS server, since DNSSEC only protects transations between DNS servers, not between clients and servers.

I would hope CAs run their own DNSSEC validating resolvers, and they don't just plug "nameserver 8.8.8.8" into resolv.conf.

Reply on news.ycombinator.com