ACME Account Key Binding via CAA Records
draft-landau-acme-caa-00

Abstract

The ACME protocol provides a means for hosts to automatically request and obtain X.509 certificates from certificate authorities. Certification authorities which implement ACME may also choose to implement the CAA DNS record, which allows a domain to communicate issuance policy to CAs. The CAA specification alone allows a domain to define policy with CA-level granularity. However, the CAA specification also provides facilities for extension to admit more granular, CA-specific policy. This specification defines such a parameter.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on October 23, 2016.

Copyright Notice

Copyright (c) 2016 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 2. Terminology
• 3. Extensions to the CAA Record
• 3.1. acme-ak Parameter
• 4. Security Considerations
• 4.1. DNSSEC
• 4.2. Authorization Freshness
• 5. IANA Considerations
• 6. Normative References
• Appendix A. Examples
• Author's Address

1. Introduction

This specification defines a parameter for the ‘issue’ and ‘issuewild’ properties of the Certification Authority Authorization (CAA) DNS resource record [RFC6844], allowing authorization conferred by a CAA policy to be restricted to specific ACME [I-D.ietf-acme-acme] accounts. The accounts are identified by account key thumbprint.

2. Terminology

In this document, the key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” are to be interpreted as described in BCP 14, RFC 2119 [RFC2119] and indicate requirement levels for compliant ACME-CAA implementations.

3. Extensions to the CAA Record

3.1. acme-ak Parameter

A CAA parameter “acme-ak” is defined for the ‘issue’ and ‘issuewild’ properties defined by [RFC6844]. The value of this parameter, if specified, MUST be the base64url [RFC4648] encoding (without padding) of the JWK thumbprint [RFC7517] of the ACME account key [I-D.ietf-acme-acme].

If an ACME server finds multiple CAA records pertaining to it (i.e., having property ‘issue’ or ‘issuewild’ as applicable and a domain that the ACME server recognises as its own) with different “acme-ak” parameters, the ACME server MUST NOT consider the CAA record set to authorize issuance unless at least one of the specified account key thumbprints matches the requesting ACME account key. A property without an “acme-ak” parameter matches any account key. A property with an invalid “acme-ak” parameter (i.e. not 43 characters long or not a valid base64url string), or multiple “acme-ak” parameters is unsatisfiable.

4. Security Considerations

This specification describes an extension to the CAA record specification increasing the granularity at which CAA policy can be expressed for ACME-based CAs. This allows the set of entities capable of successfully requesting issuance of certificates for a given domain to be restricted beyond that which would otherwise be possible, while still allowing issuance for specific ACME account keys. This improves the security of issuance for domains which choose to employ it, when combined with a CA which implements this specification.

4.1. DNSSEC

Where a domain chooses to secure its nameservers using DNSSEC, the authenticity of an ACME account key nomination placed in a CAA record can be assured, providing that a CA makes all DNS resolutions via an appropriate, trusted DNSSEC-validating resolver. In this case and so long as control of nominated keys is retained, a domain is protected from the threat posed by a global adversary capable of performing man-in-the-middle attacks, which could otherwise forge DNS responses and successfully obtain ACME authorizations and certificates for the domain.

4.2. Authorization Freshness

The CAA specification governs the act of issuance by a CA. The act of authorization as described by the ACME protocol occurs separately to issuance and may occur substantially prior to an issuance request. The CAA policy expressed by a domain may have changed in the meantime, creating the risk that a CA will issue certificates in a manner inconsistent with the presently published CAA policy.

CAs SHOULD consider adopting practices to reduce the risk of such circumstances. Possible countermeasures include issuing ACME authorizations with very limited validity periods, such as an hour, or revalidating the CAA policy for a domain at certificate issuance time.

5. IANA Considerations

None. As per the CAA specification, the parameter namespace for the CAA ‘issue’ and ‘issuewild’ properties has CA-defined semantics. This document merely specifies a RECOMMENDED semantic for a parameter of the name “acme-ak” for ACME-based CAs.

6. Normative References

Appendix A. Examples

The following shows an example DNS configuration which nominates two account keys as authorized to issue certificates for the domain “example.com”. Issuance is restricted to the CA “example.net”.

example.com. IN CAA 0 issue "example.net; \
  acme-ak=UKNmi2whPhuAhDvAxGa_aOZgPzyJDhhsrt-8Bt2fWh0"
example.com. IN CAA 0 issue "example.net; \
  acme-ak=rlp4OZPOR9MKejkOdZAKQ5Tfwce6llawmrDIh-BtNJ0"

Author's Address