logoalt Hacker News

parasyte • yesterday at 5:05 PM • 1 reply • view on HN

CAA records were never intended to be used by clients (Relying Parties), the RFC specifically prohibits them from using the CAA record to determine if the issuer was allowed to have issued the cert.

I infer from the wording around there and elsewhere in the RFC that this is mostly because someone could switch issuers but still serve valid certs from the prior issuer, and there's no way an RP would have a historical record of which CAA values were in effect when to be able to determine if the issuance was valid or not.


Replies

itintheory • today at 12:59 PM

That makes sense. Seems like there could be a different record type, similar to SPF that could be used in this way though...