<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Aug 2, 2017, at 6:23 PM, Kirk Hall via Public <<a href="mailto:public@cabforum.org" class="">public@cabforum.org</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">I have two CAA questions from our technical group. I am posting here to see what others think. Do we need to make any changes to BR 3.2.2.8 (created under Ballot 187)? Thanks for any feedback.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><u class="">QUESTION 1<o:p class=""></o:p></u></b></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Subject: CAA ballot and handling of REFUSED status response from authoritative name servers<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Suppose we have a domain "<a href="http://demo-k2k.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">demo-k2k.com</a>" that have NS records pointing to "<a href="http://ns1.demo-k2k.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">ns1.demo-k2k.com</a>" and<span class="Apple-converted-space"> </span><a href="http://ns2.demo-k2k.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">ns2.demo-k2k.com</a><span class="Apple-converted-space"> </span>as the authoritative name servers. When we query "<a href="http://ns1.demo-k2k.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">ns1.demo-k2k.com</a>" for the CAA records for "<a href="http://demo-k2k.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">demo-k2k.com</a>", it returns a status of REFUSED. This may be due to a misconfiguration or the restricted access may be intentional.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">We now have a scenario where the record lookup for "<a href="http://demo-k2k.com/" style="color: rgb(149, 79, 114); text-decoration: underline;" class="">demo-k2k.com</a>" has failed.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">According to ballot 187, CAs are permitted to treat a record lookup failure as permission to issue if:<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class=""><span class="">1.<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span>the failure is outside the CA’s infrastructure;<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class=""><span class="">2.<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span>the lookup has been retried at least once; and<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt 0.5in; font-size: 11pt; font-family: Calibri, sans-serif; text-indent: -0.25in;" class=""><span class="">3.<span style="font-style: normal; font-variant-caps: normal; font-weight: normal; font-size: 7pt; line-height: normal; font-family: 'Times New Roman';" class=""> <span class="Apple-converted-space"> </span></span></span>the domain’s zone does not have a DNSSEC validation chain to the ICANN root.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Condition #1 is satisfied, the failure is outside the CA’s infrastructure.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">We can satisfy Condition #2 by retrying – we get the same REFUSED status in the response.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Because of the "and" clause in above ballot excerpt, we must also satisfy condition #3 if we want to treat the lookup failure as permission to issue.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">We cannot, however, determine whether the "domain’s zone does not have a DNSSEC validation chain to the ICANN root" because the domain's zone authoritative name servers are refusing to answer our DNS queries.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">This scenario is encountered often enough in the real world that it would prevent many certificates from being issued if ballot 187 is followed.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">One potential solution is to allow CA's to treat REFUSED status responses from authoritative name servers as permission to issue.</div></div></div></blockquote><div><br class=""></div><div><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);">The problem with doing this is that it opens up a downgrade attack.</div><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);"><br class=""></div><div class="gmail_default" style="color: rgb(34, 34, 34); font-family: arial, sans-serif; font-size: small; font-variant-ligatures: normal; orphans: 2; widows: 2; background-color: rgb(255, 255, 255);">We know if the zone is DNSSEC signed or not (NSEC3 in the parent zone). REFUSED + DNSSEC should mean no certificate. If you turn on DNSSEC and much it up, then you are going to be in for a world of hurt anyways. That is what DNSSEC is for.</div></div><div><br class=""></div><div><br class=""></div><blockquote type="cite" class=""><div class="WordSection1" style="page: WordSection1; font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><b class=""><u class="">QUESTION 2<o:p class=""></o:p></u></b></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Subject: Handling CAA record with single character in it<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">We have found a CAA record that consists only of a semi-colon “;” So the field is not empty, but also does not designate any known CAs.<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><o:p class=""> </o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class="">Our team assumes this effectively blocks all CAs from issuing to this domain. Do others agree?<o:p class=""></o:p></div><div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif;" class=""><br class=""></div></div></blockquote><br class=""></div><div>Yes. The original intention was that a completely empty record should prevent issue. That may well be harder to enter in the config file of course. </div><div><br class=""></div>There are many domains that are bought and simply parked. They are not in use so why would someone be getting a certificate for them?</body></html>