Certification Authority Authorization (CAA) Validation for IP Addresses
draft-shoemaker-caa-ip-00

Abstract

The Certification Authority Authorization (CAA) RFC specifies a method for users to restrict which Certificate Authorities (CAs) are authorized to issue certificates for their DNS domain names. This document extends that specification to provide a method for holders of IP addresses to do the same.

Status of This Memo

This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.

Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.

Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."

This Internet-Draft will expire on March 15, 2018.

Copyright Notice

Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.

Table of Contents

• 1. Introduction
• 2. Terminology
• 3. Mechanism
• 4. IANA Considerations
• 4.1. Certification Authority Restriction Properties
• 5. Normative References
• Author's Address

1. Introduction

This document describes an extension to RFC 6844 [RFC6844] which allows for the use of Certification Authority Authorization DNS Records to be used to restrict issuance of certificates to IP addresses instead of just DNS names. This is done by defining a new lookup mechanism for IPv4 and IPv6 addresses as previously a mechanism only existed for DNS names.

2. Terminology

In this document, the key words “MUST”, “MUST NOT”, “REQUIRED”, “SHALL”, “SHALL NOT”, “SHOULD”, “SHOULD NOT”, “RECOMMENDED”, “MAY”, and “OPTIONAL” are to be interpreted as described in BCP 14, RFC 2119 [RFC2119] and indicate requirement levels for compliant ACME-Wildcard implementations.

3. Mechanism

Before issuing a certificate containing a IP address a compliant CA MUST check for the relevant CAA Resource Record set. If such a record set exists a CA MUST NOT issue a certificate unless the records in the set are consistent with the request and the policies of the CA.

A certificate request MAY specify more than one IP address in which case CAs MUST verify the CA Resource Record set for all the IP addresses specified in the request.

As defined in RFC 2818 [RFC2818] IP addresses in certificates must match exactly with the requested URI so CAs MUST NOT consider CAA records with the “issuewild” tag to be part of the relevant Resource Record set for a IP address.

Unlike the mechanism defined in RFC 6844 [RFC6844] this mechanism doesn’t involve climbing the DNS tree and only requires querying a single DNS name. The relevant Resource Record set for a given IP address is found by querying the reverse mapping zone for the IP for CAA records.

Given a certificate request containing the IPv6 address “2001:db8::1” the relevant query for the reverse mapping within the IP6.ARPA [RFC3596] zone would be:

1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa. IN CAA

And for a request containing the IPv4 address “192.0.2.1” the relevant query for the reverse mapping within the IN-ADDR.ARPA [RFC1034] zone would be:

1.2.0.192.in-addr.arpa. IN CAA

When doing queries CAs SHOULD either use a resolver that chases CNAME records or manually chase CNAMEs themselves in order to allow for zone delegations [RFC2317].

4. IANA Considerations

4.1. Certification Authority Restriction Properties

Change the contents of the Meaning column for the “issue” Tag to say “Authorization Entry by Domain or IP address” and add “draft-shoemaker-caa-ip” to the References column.

5. Normative References

Author's Address