| What about CAA records? And of course, browsers handle this with the Certificate Transparency log and the OneCRL, made less painful by baking a short-lived proof that the cert is not revoked into the handshake. The problem is all the other parts of the ecosystem that basically ignore all this new complex security stuff and just check the cert against a static list of vendored roots. For example, node, java, and python all have vendored roots and don't check any CRLs. |
| |
| ▲ | crote 5 hours ago | parent | next [-] | | > What about CAA records? Well, what about them? If you've got access to the private key, nothing is going to stop you from generating a cert violating CAA records - and it won't even be easy to detect! They are intended to protect against, say, someone hacking into your server, running ACME to get a cert, cleaning up their traces, and then intercepting your traffic for 90 days. CAA records assume the CA is trustworthy and following the rules. | |
| ▲ | kam 5 hours ago | parent | prev [-] | | CAs check CAA records, clients don't. | | |
| ▲ | aftbit 5 hours ago | parent [-] | | Oh - I thought clients did. Was there some separate kind of cert pinning that clients checked that disappeared because nobody could get it right? | | |
| ▲ | kensey 2 hours ago | parent [-] | | There's no reason clients couldn't, as far as I know (just like the various anti-spam measures where clients check for records that indicate what servers are allowed to send mail from a domain and consider it spam if those records don't match), but I also don't know of any clients that actually do. And a CAA record still doesn't actively prevent issuance of a certificate, which is really what would be needed. There used to be a pinning scheme called HPKP, but the trouble with it is it's very easy to accidentally (or via malicious third-party action) end up in a situation where your web site becomes unreachable by people who've visited it previously because the key changed and the pin prevents their browser recognizing the new key as valid: https://scotthelme.co.uk/im-giving-up-on-hpkp/ |
|
|
|
