Baseline Requirements revocation requirement

[jsha]

@bburhans

Thanks, both. I read the CAB requirements, and I am still unsure of where the boundary falls for “possibly affected certs” versus “definitely affected certs” for this incident, and I can appreciate erring on the side of caution for something as serious as CAA validation. A serious warning to all possibly affected subscribers is definitely in order either way, but since severe downtime will result for many affected subscribers, I would hope that the response is a bit more moderated, e.g. immediate revocation happens only for certs where an included domain’s CAA history has changed and could indicate a compromise of validation integrity.

In my org’s case, no revocation was necessary because all relevant domains have never had CAA records; I’m not sure how your logs could prove this, but if possible, that sort of criterion could be used to limit the revocations to a much smaller set of certificates. Could you describe how you generated the list mentioned above? I see that the list has annotations such as “missing CAA checking results for ” but it only mentions that for one of the domains in each cert.

This is actually a great question, and gets at the heart of how the BRs and CAA work. I've split it out into its own topic.

The BRs are process-oriented more than outcome-oriented, particularly in the CAA requirements. The process is "CAs must check CAA for all hostnames within 8 hours prior to certificate issuance." The outcome is "hostnames with CAA records forbidding issuance don't get certificates issued for them."

Even though the outcome is the same for your hosts (because there were never any CAA records), the problem is that we failed to properly follow the process. Per the BRs, that's grounds for revocation.

On a more practical level, because we didn't check CAA records at the proper time, we have have no way of knowing for sure that they didn't exist at that time (as you mentioned).

I'll also note: If you've checked your certificates and found they don't need renewal, it's probably not because they lacked CAA records, but because they were renewed more recently than the issuance that was affected by the bug.