<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hi all,
<div class=""><br class="">
</div>
<div class="">Although we appreciate your concerns on protecting users from incapable CA-s, we’d like to point out that we as a small CA, fear a side-effect of it being an instrument for market manipulation.<br class="">
<br class="">
Most of the concerns brought up here so far have been about corporations where there’s different admins for DNS, certificates, web content and whether this would create any trouble to them or risk to users.<br class="">
<br class="">
But consider this scenario: a hypothetical CoolCA approaching a DNS service provider, be it an ISP, domain registrar or some kind of hosting provider, with a proposal to include a CAA record pointing to the CoolCA into their default configuration. Falling to
it means that lots of small customers, who just want to set up a homepage or e-mail and who might not (yet) know anything about certificates, all of a sudden get a preferred choice of a CA. This cannot be considered an incorrect configuration, but nevertheless
our first step with potential customers in a hard-fail scenario would then be to ask them to go to the DNS provider and request changing the CAA from our competitor to us and only then come back. This is definitely extra hassle to her, it might also be extra
cost to her and it is us promoting our competitor.<br class="">
<div class=""> </div>
<div class=""><br class="">
</div>
<div class="">Best regards, <br class="">
<br class="">
Eneli Kirme<br class="">
AS Sertifitseerimiskeskus (SK)<br class="">
<br class="">
</div>
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On 19 Oct 2016, at 00:49, Ryan Sleevi via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class=""><br class="">
<div class="gmail_extra"><br class="">
<div class="gmail_quote">On Tue, Oct 18, 2016 at 12:01 PM, Jacob Hoffman-Andrews via Public
<span dir="ltr" class=""><<a href="mailto:public@cabforum.org" target="_blank" class="">public@cabforum.org</a>></span> wrote:<br class="">
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr" class="">
<div class="gmail_extra">
<div class="gmail_quote"><span class="">On Sat, Sep 10, 2016 at 10:42 PM, Eric Mill
<span dir="ltr" class=""><<a href="mailto:eric.mill@gsa.gov" target="_blank" class="">eric.mill@gsa.gov</a>></span> wrote:
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr" class="">
<div class="gmail_extra">
<div class="gmail_quote">CAA could be a straightforward way for enterprises to set an actual security policy that can be technically enforced, without the same level of risk or technical sophistication required by HPKP.</div>
</div>
</div>
</blockquote>
<div class=""><br class="">
</div>
</span>
<div class="">To clarify a bit on this point: I think CAA doesn't work well as a way to enforce top-down enterprise policy in the presence of delegated subdomains, because CAA records are checked starting from the leftmost label, and only the first record found
is considered: <a href="https://tools.ietf.org/html/rfc6844#section-4" target="_blank" class="">
https://tools.ietf.org/html/<wbr class="">rfc6844#section-4</a>.</div>
<div class=""><br class="">
</div>
<div class="">For instance, say you have a CAA record on <a href="http://example.com/" target="_blank" class="">
example.com</a> forbidding all issuance, and have a CNAME from <a href="http://blog.example.com/" target="_blank" class="">
blog.example.com</a> to a hosting provider. That hosting provider can answer CAA queries for
<a href="http://blog.example.com/" target="_blank" class="">blog.example.com</a> with a response that permits issuance. </div>
</div>
</div>
</div>
</blockquote>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr" class="">
<div class="gmail_extra">
<div class="gmail_quote">
<div class=""><br class="">
</div>
<div class="">CAA has a lot of value, but I think this is not one of the things it is useful for.</div>
</div>
</div>
</div>
</blockquote>
</div>
<br class="">
</div>
<div class="gmail_extra">I agree it's not useful for the specific case you highlighted, but I don't think it's correct to paint all of the situations Eric raised as fitting that mold. So CAA absolutely is useful for that case - but if and only if you structure
it in a way you can express CAA. But some (many?) enterprises can do that, and it is valuable for the level Eric highlights.</div>
</div>
_______________________________________________<br class="">
Public mailing list<br class="">
<a href="mailto:Public@cabforum.org" class="">Public@cabforum.org</a><br class="">
https://cabforum.org/mailman/listinfo/public<br class="">
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>