search

SSLMate / caa_helper

Generate a CAA policy
https://sslmate.com/caa/
Mozilla Public License 2.0
153 stars 35 forks source link

CAA record property tags are matched in a case sensitive manner #100

Closed CBonnell closed 6 years ago

CBonnell commented 6 years ago

RFC 6844, section 5.1 indicates that matching of property tags is to be done in a case insensitive manner. For example, this means that an "Issue" (mixed case) property tag is perfectly valid and is to be processed as an "issue" property tag.

In doing some investigation of various online CAA checkers, etc. handling of mixed case property tags, I discovered that CAA Helper's "Load Current Policy" functionality displays an unexpected error message when encountering a mixed case "Issue" property tag for a domain ("example.com has a complicated CAA policy that this tool doesn't support").

If the purpose of the CAA Helper tool is to guide users in creating CAA records that are in the canonical presentation format (as per section 5.1.1), then I believe the tool is functioning correctly. However, if that is not the purpose of the tool, then I think the logic should be changed to accept mixed case property tags.

AGWA commented 6 years ago

Thanks @CBonnell, that's a good catch. CAA helper now does a case-insensitive comparison then loading CAA records.