News for hackers. Stuff that matters.

A comment on OVH automatically migrates expiring paid SSL to Let's Encrypt certificates. Parent comment

Re:OVH automatically migrates expiring paid SSL to Let's Enc... by jedisct1 on Sunday November 13, 2016 @06:17PM (#12946352)
If the DNS zones have CAA records that don't include Letsencrypt, clients should refuse using the new certificates.

That would be a problem (provided that CAA working as expected can be qualified as a problem) if the original certificates were still valid. But with expired certificates, there is nothing to lose.

[ Parent | on HN ]
Re:OVH automatically migrates expiring paid SSL to Let's Enc... by tialaramex on Monday November 14, 2016 @03:09AM (#12948272)
No. CAA is an instruction to Certificate Authorities, not an instruction to clients.

Let's Encrypt obeys CAA, if you try to validate for a domain which has a CAA record saying e.g. "Only Symantec may issue for this domain", Let's Encrypt's software will reject the validation. Current Baseline Requirements don't require this of a CA (they're required to document what they do with CAA but most picked "soft fail" ie they will issue but maybe do extra scrutiny) because they feared it would be used somehow in an anti-competitive way.

Client software like Firefox, or Internet Explorer, ignores CAA altogether, as described in the design of CAA.

[ Parent | on HN ]