CAA Records are checked while challenge is created

[cpu]

Hi @prok_in

@prok_in

As per border implementation CAA records are checked y the server while verifying the challenge,

This true. The CAA record for the domain being authorized and the authorization response are queried by the Let's Encrypt Validation Authority (VA) at the same time when a challenge is POSTed for validation. Note that we also recheck CAA again before issuance if the issuance is relying on authorizations that were obtained more than 8 hours ago.

@prok_in

but as per draft the CAA records should be checked along with authentication before delivering the challenge.

Can you quote the section and specific draft # you're referring to? There are multiple with lots of change between them I don't believe there is any requirement that CAA be checked before attempting domain validation, just before issuance.

Can you clarify what you mean by "before delivering the challenge" - do you mean before the VA delivers the challenge verification request to the remote server? E.g. in an HTTP-01 context before the VA makes a HTTP GET to example.com/.well-known/acme-challenge/xxxxxx ?

@prok_in

But the client received the challenge and completed and scrutiny of the same failed on CAA point which should be checked by the server before delivering challenge

I'm still caught up on what "delivering" means but if I assume that it means "delivering a challenge request from the VA to the remote server" then this is what I would expect. At the time the challenge is POSTed by the client the VA will spin up a Go Routine (like a thread) to check the CAA record and it will spin up a Go Routine to make the challenge verification request. If either fail the authorization is marked invalid. There's no guarantee that if your CAA record blocks issuance that the VA will not make a request to the server at all.

Hope that helps explain,