search

SSLMate / caatestsuite

Test suite which checks compliance with CAA checking as defined in version 1.4.8 of the CABF Baseline Requirements
https://caatestsuite.com
Apache License 2.0
10 stars 4 forks source link

Adding tests that permit CAs issuing #7

Open ysf opened 6 years ago

ysf commented 6 years ago

The Baseline Requirements section 3.2.2.8. (v1.4.8+) states that:

CAs are permitted to treat a record lookup failure as permission to issue if:

  • the failure is outside the CA's infrastructure
  • the lookup has been retried at least once; and
  • the domain's zone does not have a DNSSEC validation chain to the ICANN root.

It'll be great to have the last point checked by some tests. As I understand it a CA may issue if i.e. a DS record is not set or alike that'll break the chain to the ICANN root no matter if a CAA-RR was used or not.