A First Look at Certification Authority Authorization (CAA)

Abstract

Shaken by severe compromises, the Web's Public Key Infrastructure has seen the addition of several security mechanisms over recent years. One such mechanism is the Certification Authority Authorization (CAA) DNS record, that gives domain name holders control over which Certification Authorities (CAs) may issue certificates for their domain. First defined in RFC 6844, adoption by the CA/B forum mandates that CAs validate CAA records as of September 8, 2017. The success of CAA hinges on the behavior of three actors: CAs, domain name holders, and DNS operators. We empirically study their behavior, and observe that CAs exhibit patchy adherence in issuance experiments, domain name holders configure CAA records in encouraging but error-prone ways, and only six of the 31 largest DNS operators enable customers to add CAA records. Furthermore, using historic CAA data, we uncover anomalies for already-issued certificates. We disseminated our results in the community. This has already led to specific improvements at several CAs and revocation of mis-issued certificates. Furthermore, in this work, we suggest ways to improve the security impact of CAA. To foster further improvements and to practice reproducible research, we share raw data and analysis tools.

MERCAT: A Metric for the Evaluation and Reconsideration of Certificate Authority Trustworthiness

“…There are also results on the submetric level of other SMGs which are worth discussing. The CAA Submetric's results, for example, confirm an observation already reported by Scheitle et al [60]. Although consistently rejecting CSRs with a conflicting issue property tag in the CAA RR, none of the assessed CAs makes use of iodef notifications in the case of rejection.…”

Domain Impersonation is Feasible: A Study of CA Domain Validation Vulnerabilities

“…Scheitle et al [35] surveyed the adoption of the CAA record and compliance to it. Compared to our work they examine the CAA mechanism only, but in greater depth as they uncover certificate misissuance with deliberately broken CAA configurations.…”

A Long Way to the Top

“…CAA Adoption: Exemplary for other record types, we also investigate the adoption of Certification Authority Authorization (CAA) records in top lists and the general population. CAA is a rather new record type, and has become mandatory for CAs to check before certificate issuance, cf., [122,128]. We measure CAA adoption as described in [122], i.e., the count of base domains with an issue or issuewild set.…”

“…CAA is a rather new record type, and has become mandatory for CAs to check before certificate issuance, cf., [122,128]. We measure CAA adoption as described in [122], i.e., the count of base domains with an issue or issuewild set. Similar to IPv6 adoption, we find CAA adoption among top lists (1-2%) to significantly exceed adoption among the general population at 0.1%.…”