CAA Record Extensions for Account URI and ACME Method Binding
draft-ietf-acme-caa-01

• Status
• IESG evaluation record
• IESG writeups
• Email expansions
• History

• Versions
• 00
• 01
• 02
• 03
• 04
• 05
• 06
• 07

ACME Working Group                                             H. Landau
Internet-Draft                                         February 04, 2017
Intended status: Standards Track
Expires: August 8, 2017

     CAA Record Extensions for Account URI and ACME Method Binding
                         draft-ietf-acme-caa-01

Abstract

   The CAA DNS record allows a domain to communicate issuance policy to
   CAs, but only allows a domain to define policy with CA-level
   granularity.  However, the CAA specification also provides facilities
   for extension to admit more granular, CA-specific policy.  This
   specification defines two such parameters, one allowing specific
   accounts of a CA to be identified by URI and one allowing specific
   methods of domain control validation as defined by the ACME protocol
   to be required.

Status of This Memo

   This Internet-Draft is submitted in full conformance with the
   provisions of BCP 78 and BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF).  Note that other groups may also distribute
   working documents as Internet-Drafts.  The list of current Internet-
   Drafts is at http://datatracker.ietf.org/drafts/current/.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   This Internet-Draft will expire on August 8, 2017.

Copyright Notice

   Copyright (c) 2017 IETF Trust and the persons identified as the
   document authors.  All rights reserved.

   This document is subject to BCP 78 and the IETF Trust's Legal
   Provisions Relating to IETF Documents
   (http://trustee.ietf.org/license-info) in effect on the date of
   publication of this document.  Please review these documents
   carefully, as they describe your rights and restrictions with respect
   to this document.  Code Components extracted from this document must

Landau                   Expires August 8, 2017                 [Page 1]
Internet-Draft                  ACME-CAA                   February 2017

   include Simplified BSD License text as described in Section 4.e of
   the Trust Legal Provisions and are provided without warranty as
   described in the Simplified BSD License.

Table of Contents

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Terminology . . . . . . . . . . . . . . . . . . . . . . . . .   2
   3.  Extensions to the CAA Record: account-uri Parameter . . . . .   3
     3.1.  Use with ACME . . . . . . . . . . . . . . . . . . . . . .   3
     3.2.  Use without ACME  . . . . . . . . . . . . . . . . . . . .   4
   4.  Extensions to the CAA Record: acme-methods Parameter  . . . .   4
   5.  Security Considerations . . . . . . . . . . . . . . . . . . .   4
     5.1.  Limited to CAs Processing CAA Records . . . . . . . . . .   4
     5.2.  Restrictions Ineffective without CA Recognition . . . . .   5
     5.3.  Mandatory Consistency in CA Recognition . . . . . . . . .   5
     5.4.  URI Ambiguity . . . . . . . . . . . . . . . . . . . . . .   6
     5.5.  Authorization Freshness . . . . . . . . . . . . . . . . .   6
     5.6.  DNSSEC  . . . . . . . . . . . . . . . . . . . . . . . . .   7
     5.7.  Use without DNSSEC  . . . . . . . . . . . . . . . . . . .   7
     5.8.  Restrictions Supercedable by DNS Delegation . . . . . . .   7
   6.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   8
   7.  Normative References  . . . . . . . . . . . . . . . . . . . .   8
   Appendix A.  Examples . . . . . . . . . . . . . . . . . . . . . .   8
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   9

1.  Introduction

   This specification defines two parameters for the "issue" and
   "issuewild" properties of the Certification Authority Authorization
   (CAA) DNS resource record [RFC6844].  The first, "account-uri",
   allows authorization conferred by a CAA policy to be restricted to
   specific accounts of a CA, which are identified by URIs.  The second,
   "acme-methods", allows the set of validation methods supported by an
   ACME [I-D.ietf-acme-acme] based CA to validate domain control to be
   limited to a subset of the full set of methods which it supports.

2.  Terminology

   In this document, the key words "MUST", "MUST NOT", "REQUIRED",
   "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY",
   and "OPTIONAL" are to be interpreted as described in BCP 14, RFC 2119
   [RFC2119] and indicate requirement levels for compliant ACME-CAA
   implementations.

Landau                   Expires August 8, 2017                 [Page 2]
Internet-Draft                  ACME-CAA                   February 2017

3.  Extensions to the CAA Record: account-uri Parameter

   A CAA parameter "account-uri" is defined for the "issue" and
   "issuewild" properties defined by [RFC6844].  The value of this