Re:OVH automatically migrates expiring paid SSL to Let's Enc...
by tialaramex on Monday November 14, 2016 @03:09AM
(#12948272)
No. CAA is an instruction to Certificate Authorities, not an instruction to clients.
Let's Encrypt obeys CAA, if you try to validate for a domain which has a CAA record saying e.g. "Only Symantec may issue for this domain", Let's Encrypt's software will reject the validation. Current Baseline Requirements don't require this of a CA (they're required to document what they do with CAA but most picked "soft fail" ie they will issue but maybe do extra scrutiny) because they feared it would be used somehow in an anti-competitive way.
Client software like Firefox, or Internet Explorer, ignores CAA altogether, as described in the design of CAA.
Let's Encrypt obeys CAA, if you try to validate for a domain which has a CAA record saying e.g. "Only Symantec may issue for this domain", Let's Encrypt's software will reject the validation. Current Baseline Requirements don't require this of a CA (they're required to document what they do with CAA but most picked "soft fail" ie they will issue but maybe do extra scrutiny) because they feared it would be used somehow in an anti-competitive way.
Client software like Firefox, or Internet Explorer, ignores CAA altogether, as described in the design of CAA.