Hi Quirin, On 15/12/17 15:09, Quirin Scheitle wrote: > The results, paper, and a dashboard tracking CAA adoption are available under > > https://caastudy.github.io/
Belatedly, thank you and your colleagues for doing this excellent work. It is interesting that you have received no iodef messages at all. I can imagine CAs deprioritizing that work in favour of getting their implementations right. I can see a time, when CAA implementations have settled down and are reliable, that we might look at mandatory reporting of attempted misissuance. CAs are already able to use CA-specific tags to restrict particular validation methods and certificate types; this is something I think it's reasonable to let the market provide if there is demand. The DNS operator privilege is there because it doesn't make too much sense for an organization to ask itself for permission to issue. I would expect CAs to be storing the results of their CAA lookups in their issuance logs, in sufficient detail for them to be checked later, even if they are not published. I share your hope that the deployment and use of CAA, and the accuracy and consistency of checking, will improve in the days ahead. It will be fascinating if you are able to repeat this research in six or twelve months time. One other quote: "For 1 domain, our scans showed a CAA configuration that consistently did not permit any CA to issue, yet a certificate was issued during this time. Upon inquiry, the domain name holder confirmed that they had fully automated their certifi- cate issuance process, including automatic reconfiguration of CAA records for a brief time period." That's pretty awesome :-) Gerv _______________________________________________ dev-security-policy mailing list dev-security-policy@lists.mozilla.org https://lists.mozilla.org/listinfo/dev-security-policy