Unify sections regarding CAA

[aarongable]

Currently:

• Section 2.2 states

  Section 4.2 of a CA's Certificate Policy and/or Certification Practice Statement SHALL state the CA's policy or practice on processing CAA Records for Fully-Qualified Domain Names; that policy shall be consistent with these Requirements. It shall clearly specify the set of Issuer Domain Names that the CA recognizes in CAA "issue" or "issuewild" records as permitting it to issue. The CA SHALL log all actions taken, if any, consistent with its processing practice.

• Section 3.2.2.8 is entitled "CAA Records" and contains numerous requirements regarding CAA checking

• And Section 4.2 has nothing to say about CAA, despite the fact that CA's are required to document their own CAA-checking practices here, as per Section 2.2.

These should be unified. In my opinion, the paragraph in Section 2.2 should be removed, and anything we want to keep from it should be moved into Section 3.2.2.8. Then CAs can similarly move all of their CAA practices into Section 3.2.2.8 of their CP/CPS.

[bcmorton]

I would vote Yes to that change.

[srdavidson]

The SMIME BR will also address CAA and has no section 3.2.2.8. Consolidating the CAA requirements under 4.2 allows consistency across the two standards. Here's the draft for CAA in the SMIME BR. https://github.com/srdavidson/smime/compare/241e92cde85c25d7e0d4a5c70118ecadacd4d72b...c8b0c9ff9fa28c2c7abeb2871aaa2d60a19842ed

[ryancdickson]

Added this to the scope of the Multi-Perspective Issuance Corroboration work thanks to the reminder from @aarongable.

Updated language can be found here via these commits: https://github.com/ryancdickson/staging/pull/8/commits/0525044a051bad888caf1072111a8c5717fe1cfa and https://github.com/ryancdickson/staging/commit/8315b6a3a338ea6b47cf99979b0d97f61e5f3363

Summary:

• Deleted the CAA paragraph from 2.2
• Added what I felt was relevant content from 2.2 into 3.2.2.8
• Did some minor housekeeping

@bcmorton / @srdavidson - your review and feedback are welcome, along with other members of the community!

[srdavidson]

Here's the S/MIME BR (SBR) equivalent. https://github.com/cabforum/smime/pull/228/file For issuers, it's preferable have similar requirements in similar sections. SBR has no 3.2.2.8 so its CAA content is is 4.2.2.1 ... however both the SBR and this text require documentation of CAA practices in section 4.2 so that should be fine.