Re: Enabling ACME CAA Account and Method Binding

[petercooperjr]

@rg305

Of those, how many would be renewing in a way that could be affected by this "catch-22"?

The ones that are both changing validation methods or account URI, while at the same time adding conflicting CAA restrictions by validation method or account URI? I'm not seeing why that would happen that often.

[rg305]

@petercooperjr

I'm not seeing why that would happen that often.

Account restrictions are done at the DNS/domain level.
That simple little change could affect ALL users - which might not all be using the same LE account.
Which in the case of laaaarge users, might be thousands of systems.

[MikeMcQ]

@aarongable

Thinking about it some more, this scenario would arise specifically when a client
a) wants to re-issue on a shorter-than-usual timeframe;
b) wants to change which validation method they use; and
c) wants to use CAA to enforce their new validation method
all at the same time.

I admit to not understanding all the nuances of the cached auth. But, in practical terms, wouldn't someone be affected if:

1. Requesting first wildcard cert after getting non-wildcard with HTTP challenge
2. Request within 30 days of last cert
3. Use new CAA format for validation method

I believe this is just re-framing Aaron's specs from technical to situational. And, if accurate, shows a fairly simple change (to wildcard) could fail for no apparent reason.

[aarongable]

It's a good thought, but no, that failure mode is not possible. When requesting a wildcard cert, we know that DNS-01 is the only acceptable validation method ahead of time. If there are any cached validations which used other methods, those are not deemed acceptable and are not attached to the new order. So switching from non-wildcard to wildcard can't trigger this failure mode.

[orangepizza]

just *.acme.com wouldn't cause it, but isn't cert order with base domain and wildcard of that domain will hit by this edge? sni: dns: acme.com, dns: *.acme.com adding base domain itself to wildcard certificate is standard process as wildcard doesn't cover base domain itself.

[petercooperjr]

@rg305

Account restrictions are done at the DNS/domain level.
That simple little change could affect ALL users - which might not all be using the same LE account.
Which in the case of laaaarge users, might be thousands of systems.

I think generally, the people updating the CAA record would be doing do in order to try to break the integrations that aren't using the approved, central LE account. Like in this thread from a couple years ago, where the owners of the domain were trying to figure out how to stop the users that hosted subdomains from doing their own HTTP-01 challenge instead of going through the central system.