News for hackers. Stuff that matters.

A comment on GitHub Pages generated a TLS cert for my own domain. Parent comment

Re:GitHub Pages generated a TLS cert for my own domain by move-on-by on Wednesday April 18, 2018 @08:57AM (#16866974)
> you can prevent this by setting CAA DNS records on your own domain

Well this is interesting, I already have a CAA DNS record on my root domain, but of course its also set to 'letsencrypt.org' since that is what I use on my root domain. Although I don't guess it matters since its on the root and not the subdomain

Edit: Actually, looks like a CAA record on the root domain will also limit subdomains. So, although I already had a CAA record setup, looks like this new Github feature will work as expected when it rolls out to my account without any changes since I was already using letsencrypt

[ Parent | on HN ]
Re:GitHub Pages generated a TLS cert for my own domain by web007 on Wednesday April 18, 2018 @11:47AM (#16868299)
If your DNS host supports it (Route53 does), you can set a wildcard CAA record with no valid issuers that will do what you want.

Bare -> LE delegation WWW -> explicit LE delegation * -> no delegations, and will override "bare" since resolution walks up the domain tree.

[ Parent | on HN ]