<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Wouldn't that be covered by</p>
<blockquote>
<p>"CAs are permitted to treat a record lookup failure as
permission to issue if:</p>
<blockquote>
<p>• the failure is outside the CA’s infrastructure; and</p>
<p>• the lookup has been retried at least once; and</p>
<p>• the domain’s zone does not have a DNSSEC validation chain
to the ICANN root."
</p>
</blockquote>
</blockquote>
<div class="moz-cite-prefix">The DNS lookup would fail with
NXDOMAIN, and the failure probably isn't in the CA's
infrastructure, and if the DNS lookup failed, that would also
indicate that no valid DNSSEC chain exists (at least, I don't see
DS records for onion in the root zone). I guess to be 100% sure,
you'd need to perform the lookup at least twice.<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">I guess that, since issuance
requirements for onion is specifically carved out in Appendix B,
it might make sense to carve out an explicit exception for that
domain. Although if in a future revision of the technology, CAA
policies could be expressed for onion addresses, I think we'd want
to see those policies honoured, no?</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Just some thoughts,</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Neil<br>
</div>
<div class="moz-cite-prefix"> <br>
</div>
<div class="moz-cite-prefix">On 26/01/2021 10:08, Dimitris
Zacharopoulos (HARICA) via Servercert-wg wrote:<br>
</div>
<blockquote type="cite"
cite="mid:010001773e2a3a33-206b442f-e4c2-47ad-8194-65ca2b5cbb05-000000@email.amazonses.com">Dear
Members,
<br>
<br>
I was doing a review of CAA requirements in the BRs. Unless I am
missing something, section 3.2.2.8 seems to enforce the CAA check
for all certificate types, including onion certificates. I believe
there should be an exemption for onion certificates since they do
not use the DNS that chains to the ICANN root.
<br>
<br>
Do others feel that we need to clarify this further in the BRs
either in section 3.2.2.8 or in Appendix B?
<br>
<br>
<br>
Thank you,
<br>
Dimitris.
<br>
_______________________________________________
<br>
Servercert-wg mailing list
<br>
<a class="moz-txt-link-abbreviated" href="mailto:Servercert-wg@cabforum.org">Servercert-wg@cabforum.org</a>
<br>
<a class="moz-txt-link-freetext" href="https://lists.cabforum.org/mailman/listinfo/servercert-wg">https://lists.cabforum.org/mailman/listinfo/servercert-wg</a>
<br>
</blockquote>
</body>
</html>