RFC 8657

Certification Authority Authorization (CAA) Record Extensions for Account URI and Automatic Certificate Management Environment (ACME) Method Binding

📅 published November 2019, from ietf

RFC 8657: Certification Authority Authorization (CAA) Record Extensions for Account URI and Automatic Certificate Management Environment (ACME) Method Binding 💖

okay bestie, so this is RFC 8657 🎀 by H. Landau 🦋. It's a Standards Track document from November 2019 (ISSN 2070-1721) ✨. The title block doesn't list anything it obsoletes or updates, so it's just doing its own thing 💅

Abstract 🌸

The CAA DNS record lets a domain tell Certification Authorities (CAs) what its issuance policy is, but only at CA-level granularity 🙃. The CAA spec (RFC 8659) does leave room for an extension that's more granular and CA-specific. This spec defines two of those: one lets specific accounts of a CA be identified by URIs, and the other lets specific domain control validation methods from the Automatic Certificate Management Environment (ACME) protocol be required 🔥

Status of This Memo 📜

This is an Internet Standards Track document ✨

It's a product of the Internet Engineering Task Force (IETF), so it reflects the consensus of the IETF community. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). For more on Internet Standards, check Section 2 of RFC 7841 🧚

You can find the current status, any errata, and how to send feedback at https://www.rfc-editor.org/info/rfc8657 🍓

Copyright Notice ©️

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which you can read at https://trustee.ietf.org/license-info (as they stand on the publication date). Please actually read these, because they spell out your rights and restrictions for this doc 🙈 Code Components pulled out of this document have to include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as the Simplified BSD License describes 🫶

Table of Contents 🗂️

   1.  Introduction
   2.  Terminology
   3.  Extensions to the CAA Record: The "accounturi" Parameter
     3.1.  Use with ACME
     3.2.  Use without ACME
   4.  Extensions to the CAA Record: The "validationmethods" Parameter
   5.  Security Considerations
     5.1.  Limited to CAs Processing CAA Records
     5.2.  Restrictions Ineffective without CA Recognition
     5.3.  Mandatory Consistency in CA Recognition
     5.4.  URI Ambiguity
     5.5.  Authorization Freshness
     5.6.  Use with and without DNSSEC
     5.7.  Restrictions Supersedable by DNS Delegation
     5.8.  Misconfiguration Hazards
     5.9.  Revelation of Account URIs
   6.  IANA Considerations
   7.  Normative References
   Appendix A.  Examples
   Author's Address

1. Introduction 💅

This spec defines two parameters for the "issue" and "issuewild" Properties of the CAA DNS resource record [RFC8659]. The first one, "accounturi", lets a CAA policy's authorization be narrowed down to specific accounts at a Certification Authority (CA), and those accounts are identified by URIs 🎯 The second one, "validationmethods", lets you limit a CA's domain validation to a subset of the methods it supports, rather than the full set ✨

2. Terminology 📖

Here are the key words, which are the official vocab for this doc 🎀 "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" all get read the way BCP 14 [RFC2119] [RFC8174] describes. But only when they're written in all capitals, like they are right here 💖

3. Extensions to the CAA Record: The "accounturi" Parameter 🦋

This doc defines the "accounturi" CAA parameter for the "issue" and "issuewild" Properties defined by [RFC8659]. If you specify a value for this parameter, it MUST be a URI [RFC3986] that identifies a specific CA account 🔗

"CA account" means an object maintained by a specific CA. It can request certificate issuance, and it represents a specific entity or a group of related entities 🧚

Here's where it gets strict, bestie 👑 When a CAA Property has an "accounturi" parameter, a CA MUST only consider that Property as authorizing issuance for a given certificate request if the CA recognizes the URI in the parameter's value as identifying the account making that request 😭

Some extra rules, because they matter: a Property with no "accounturi" parameter matches any account 🌈 A Property with an invalid or unrecognized "accounturi" parameter is unsatisfiable 💀 A Property with multiple "accounturi" parameters is also unsatisfiable 🙅

The "accounturi" parameter doesn't replace or supersede the need to validate the domain name in an "issue" or "issuewild" record the way the CAA spec describes [RFC8659]. CAs MUST still perform that validation ✨ For example, a CAA "issue" Property that names a domain belonging to CA A, with an "accounturi" parameter pointing at an account at CA B, is unsatisfiable 😵‍💫

3.1. Use with ACME 🌸

An ACME account object [RFC8555] can be identified by setting the "accounturi" parameter to the URI of that ACME account object 🫶

Implementations of this spec that also implement ACME MUST recognize those URIs 💜

3.2. Use without ACME 🧚

The "accounturi" spec gives you a general mechanism for identifying entities that can request certificate issuance, using URIs ✨ Specific kinds of URIs might get specified in future RFCs, and CAs that don't implement ACME can assign and recognize their own URIs however they like 🎀

4. Extensions to the CAA Record: The "validationmethods" Parameter 🍓

This doc also defines the "validationmethods" CAA parameter for the "issue" and "issuewild" Properties 💖 If you specify a value for it, the value MUST be a comma-separated string of zero or more validation method labels 🌈

A validation method label identifies a validation method. A validation method is a particular way a CA can validate control over a domain 🔍

The presence of this parameter constrains the Property it's attached to. A CA MUST only consider a Property with the "validationmethods" parameter as authorizing issuance where the validation method being used is identified by one of the labels in the comma-separated list 👑

Each validation method label MUST be either the label of a method defined in the "ACME Validation Methods" IANA registry [RFC8555], or a CA-specific non-ACME validation method label, which is defined below 🦋

If a CA supports both the "validationmethods" parameter and one or more non-ACME validation methods, it MUST assign labels to those methods. If the right non-ACME labels aren't already in the "ACME Validation Methods" IANA registry, the CA MUST use labels that begin with the string "ca-", which are defined to have CA-specific meaning 🧚‍♀️

The value of the "validationmethods" parameter MUST follow this ABNF [RFC5234] 🙇‍♀️

      value = [*(label ",") label]
      label = 1*(ALPHA / DIGIT / "-")

5. Security Considerations 💀

This spec is an extension to the CAA record spec, and it makes the granularity of a CAA policy finer 🔐 It lets a domain restrict who can successfully request certificates for it, beyond what would otherwise be possible, and it still lets you allow issuance for specific accounts at a CA 🎯 This makes issuance more secure for domains that choose to use it, as long as the CA implements this spec too 🛡️

5.1. Limited to CAs Processing CAA Records 🚧

All of the security considerations in [RFC8659] carry over to this doc 📚 This spec only lets a domain that already has a relationship with a CA tighten that CA's issuance practices, assuming the CA implements this spec 🫶 For any other CA, it adds no security beyond what the unextended CAA spec already gives you, and any other CA's ability to issue certificates for the domain stays exactly the same 🙅

So a domain that uses CAA records to authorize only CAs that adopt this spec, and then constrains its policy with it, is still exposed to unauthorized issuance by CAs that don't honor CAA records, or only honor them as advice 😬 If the domain uses DNSSEC, it's also still exposed to CAs that honor CAA records but don't validate them through a trusted DNSSEC-validating resolver 💀

5.2. Restrictions Ineffective without CA Recognition 🙈

The parameters on "issue" or "issuewild" CAA Properties make up a CA-specific namespace. That means the CA named in the Property decides which parameters it recognizes and what they mean 🧠 So the CAA parameters in this spec depend on the named CA recognizing them, and they aren't an effective means of controlling issuance unless the CA's support for them is established beforehand ✨

CAs that implement this spec SHOULD make documentation available that says so, including explicit statements about which parameters they support 📝 Domains that configure CAA records for a CA MUST NOT assume the restrictions implied by the "accounturi" and "validationmethods" parameters are effective unless that CA explicitly says so 🚨

CAs SHOULD also document whether they do DNSSEC validation for the DNS lookups they make for validation purposes, since that affects how secure the "accounturi" and "validationmethods" parameters are 🔐

5.3. Mandatory Consistency in CA Recognition 🫧

A CA MUST make sure its support for the "accounturi" and "validationmethods" parameters is fully consistent for any given domain name that the CA recognizes as identifying itself in a CAA "issue" or "issuewild" Property 💅 If a CA runs multiple issuance systems (say, an ACME-based one and a non-ACME-based one, or two issuance systems that came from a corporate merger), it MUST make sure every one of those systems recognizes the same parameters 👯‍♀️

A CA that can't do this MAY still implement the parameters by splitting itself into two domain names for CAA processing 🪄 For example, a CA "example.com" with an ACME-based issuance system and a non-ACME-based one could recognize only acme.example.com for the former and example.com for the latter. It would then implement support for "accounturi" and "validationmethods" for acme.example.com only 🦋

A CA that can't ensure consistent processing of the "accounturi" parameter or the "validationmethods" parameter for a given CA domain name, the kind that can be specified in CAA "issue" or "issuewild" Properties, MUST NOT implement support for these parameters 🚫 If it did, its implementation of these parameters wouldn't provide effective security, and that's a whole mess nobody wants 😭💖

5.4. URI Ambiguity 🔍

okay so picture this bestie 👀 CA A recognizes "a.example.com" as itself, and CA B is a subsidiary of CA A that recognizes BOTH "a.example.com" AND "b.example.com" as itself 💅

Now both CA A and CA B issue account URIs that look like this: urn:example:account-id:1234

If the CA domain name in a CAA record is "a.example.com", that could mean account 1234 at CA A OR account 1234 at CA B. Those could be totally different accounts, and that is the ambiguity 😭 Not it!

So, CAs MUST ensure that the URIs they recognize as belonging to a specific account of that CA are unique within the scope of all domain names they recognize as identifying that CA for CAA record validation. No duplicates, no drama 🫶

CAs SHOULD satisfy this by using URIs that include an authority (see Section 3.2 of [RFC3986]), like this: https://a.example.com/account/1234 ✨

5.5. Authorization Freshness ⏰

The CAA specification [RFC8659] is the thing that governs the act of issuance by a CA 💖 But sometimes a CA sets up authorization for an account to request certificates for a specific domain separately from the issuance itself. That authorization might happen way before anyone actually asks for a certificate.

Here's the tea: the CAA policy a domain publishes may have changed in the meantime 😬 So there's a risk that a CA ends up issuing certificates in a way that doesn't match the CAA policy that's currently published. Main character energy for the wrong reasons 💀

CAs SHOULD adopt practices to lower the risk of this. Possible countermeasures include issuing authorizations with very limited validity periods, such as an hour, or revalidating the CAA policy for a domain at certificate issuance time 🌸

5.6. Use with and without DNSSEC 🔐

Okay this one is important, bestie 🥹 The "domain validation" model that's commonly used for certificate issuance usually can't protect against adversaries who can pull off global man-in-the-middle attacks against a particular domain. A global man-in-the-middle attack is one that can intercept traffic to or from a given domain, no matter where that traffic starts or ends. That kind of adversary can intercept all the validation traffic a CA starts, and so they can appear to control the domain 😱

Where a domain is signed with DNSSEC, the authenticity of its DNS data can be assured, as long as a given CA makes all of its DNS resolutions through a trusted DNSSEC-validating resolver 🧚 A domain can use this to protect itself from an adversary who can do a global man-in-the-middle attack against it.

To make that work, a CA validation process must either rely solely on information obtained via DNSSEC, or meaningfully bind the other parts of the validation transaction using material obtained via DNSSEC.

The CAA parameters in this spec can be used to make sure only validation methods that meet these criteria get used 👑 Specifically, a domain secured with DNSSEC SHOULD do one of the following:

Use the accounturi parameter to make sure only accounts it controls are authorized to obtain certificates, or
Exclusively use validation methods that rely solely on information obtained via DNSSEC, and use the validationmethods parameter to make sure only those methods are used.

A CA that supports the accounturi parameter or the validationmethods parameter MUST perform CAA validation using a trusted DNSSEC-validating resolver 🫶

"Trusted" here means the CA both trusts the resolver itself AND makes sure the communications path between the resolver and the system doing CAA validation is secure. It is RECOMMENDED that a CA do this by using a DNSSEC-validating resolver running on the same machine as the system doing CAA validation 🦋

Using the accounturi or validationmethods parameter does NOT give extra security against an attacker who can do a man-in-the-middle attack against all validation attempts made by a given CA that is authorized by CAA, when:

The domain does not secure its nameservers using DNSSEC, or
That CA does not perform CAA validation using a trusted DNSSEC-validating resolver.

And honestly, these parameters also don't fix man-in-the-middle attacks against CAs that don't validate CAA records, or that don't do it through a trusted DNSSEC-validating resolver, no matter whether those CAs are authorized by CAA. See Section 5.1 for more on that 🙈

In these cases though, the accounturi and validationmethods parameters still give an effective means of administrative control over issuance, except where control over DNS is subdelegated (see below) ✨

5.7. Restrictions Supersedable by DNS Delegation 🚪

CAA records get located during validation by walking up the DNS hierarchy until one or more records are found 🪜 So CAA records are NOT an effective way to restrict or control issuance for subdomains of a domain, when control over those subdomains has been delegated to another party. That includes DNS delegation or giving someone limited access to manage subdomain DNS records. Plot twist 😬

5.8. Misconfiguration Hazards ⚠️

The accounturi and validationmethods parameters express restrictive security policies, so misconfiguring them may result in legitimate issuance requests being refused. Be careful, bestie 🫠

5.9. Revelation of Account URIs 👀

CAA records are publicly accessible, so using the accounturi parameter lets third parties see the authorized account URIs for a domain 🌈 This may let third parties spot a correlation between domains if those domains use the same account URIs.

CAs are encouraged to select and process account URIs under the assumption that untrusted third parties may learn of them 🧚

6. IANA Considerations 🌷

This document has no IANA actions. As per [RFC8659], the parameter namespace for the CAA "issue" and "issuewild" Properties has CA-defined semantics, and the identifiers in that namespace may be freely and arbitrarily assigned by a CA. This document just specifies recommended semantics for parameters named accounturi and validationmethods, which CAs may choose to adopt 💅

7. Normative References 📚

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC3986]  Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform
           Resource Identifier (URI): Generic Syntax", STD 66,
           RFC 3986, DOI 10.17487/RFC3986, January 2005,
           <https://www.rfc-editor.org/info/rfc3986>.

[RFC5234]  Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
           Specifications: ABNF", STD 68, RFC 5234,
           DOI 10.17487/RFC5234, January 2008,
           <https://www.rfc-editor.org/info/rfc5234>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[RFC8555]  Barnes, R., Hoffman-Andrews, J., McCarney, D., and J.
           Kasten, "Automatic Certificate Management Environment
           (ACME)", RFC 8555, DOI 10.17487/RFC8555, March 2019,
           <https://www.rfc-editor.org/info/rfc8555>.

[RFC8659]  Hallam-Baker, P., Stradling, R., and J. Hoffman-Andrews,
           "DNS Certification Authority Authorization (CAA) Resource
           Record", RFC 8659, DOI 10.17487/RFC8659, November 2019,
           <https://www.rfc-editor.org/info/rfc8659>.

Appendix A. Examples 🎀

Here's an example DNS zone file fragment that nominates two account URIs as authorized to issue certificates for the domain "example.com". Issuance is restricted to the CA "example.net" 💖

example.com. IN CAA 0 issue "example.net; \
  accounturi=https://example.net/account/1234"
example.com. IN CAA 0 issue "example.net; \
  accounturi=https://example.net/account/2345"

Next, a zone file fragment that restricts the ACME methods that can be used. Only ACME methods "dns-01" and "xyz-01" can be used 🧚

example.com. IN CAA 0 issue "example.net; \
  validationmethods=dns-01,xyz-01"

Here's an equivalent way of saying the same thing 🔁

example.com. IN CAA 0 issue "example.net; validationmethods=dns-01"
example.com. IN CAA 0 issue "example.net; validationmethods=xyz-01"

Now a zone file fragment where one account can be used to issue with the "dns-01" method, and one account can be used to issue with the "http-01" method 🌸

example.com. IN CAA 0 issue "example.net; \
  accounturi=https://example.net/account/1234; \
  validationmethods=dns-01"
example.com. IN CAA 0 issue "example.net; \
  accounturi=https://example.net/account/2345; \
  validationmethods=http-01"

Last one: a zone file fragment where only ACME method "dns-01" or a CA-specific method "ca-foo" can be used 🌈

example.com. IN CAA 0 issue "example.net; \
  validationmethods=dns-01,ca-foo"

Author's Address 🖊️

Hugo Landau

Email: hlandau@devever.net

📦 where this page comes from

ietf: rfc8657 2019-11
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms