▲ | agwa 3 days ago | |||||||
No, because the CAA record only has to be in place at the time of issuance, rather than the whole lifetime of the certificate. Even if the semantics of CAA were changed, the challenges described in paragraph 3 of this post would apply: https://www.imperialviolet.org/2015/01/17/notdane.html | ||||||||
▲ | londons_explore 3 days ago | parent [-] | |||||||
> No, because the CAA record only has to be in place at the time of issuance, rather than the whole lifetime of the certificate. could we change this? Ie. if the CAA record disappears, it would be a reason to revoke a certificate? Then 3rd parties could scan transparency logs and CAA records and flag discrepancies. | ||||||||
|