CAA Record: Is it worth it?

I think that checking CAA is actually a bunch of headaches for the CAs, they just go through with it because (1) people want it (at least the people running the trust stores), and (2) it helps protect them somewhat from a malicious actor getting certificates that they aren't supposed to, even if the domain validation is correct. Certainly the details of getting it all right caused a big headache for Let's Encrypt and is a source of further compliance issues for other CAs too. It may not be great, but there are downsides to any CA with an issue possibly causing problems for all domains, not just those of their customers.

Because bugs happen. Look at Mozilla's current CA incident list. Each incident is a big problem, though rarely it's about validating a domain incorrectly (though sometimes it is!). But CAA lets the scope of the problem be just slightly smaller, and helps me protect my domain against the bugs of CAs that I don't use.

Sure it is. But it's convenient if one (as an IT administrator) can just put something in DNS to only use the official contracted or preferred CA, and not worry about what developers have managed to use HTTP-01 authentications for that the administrator don't know about. (Hopefully the administrator doing so has standardized a process to make it really easy for the developers/marketing/etc. to be able to get a real certificate without jumping through a lot of hoops, too.) I could imagine other advantages too, like checking the CAA for my domain (and even my subdomains) might be easier to automate in a self-security-scan, versus auditing that all my servers only use CAs I'm expecting.

4 Likes