search

drwetter / testssl.sh

Testing TLS/SSL encryption anywhere on any port
https://testssl.sh
GNU General Public License v2.0
7.8k stars 1.01k forks source link

[Feature request] DNS CAA records: support checking for Extensions for Account URI and ACME Method Binding (RFC 8657) #2483

Open Seirdy opened 4 months ago

Seirdy commented 4 months ago

Which version are you referring to

3.2rc3, Using "OpenSSL 3.1.1 30 May 2023 (Library: OpenSSL 3.1.1 30 May 2023)" [~94 ciphers]

Describe your feature request (if it's a technical feature)

testssl.sh currently checks for CAA records. It doesn't check or validate RFC 8657's extensions for account and method binding, which restrict who can request certificates and how.

Describe the solution you'd like

testssl.sh can check for and validate the accounturi and validationmethods parameters of a CAA DNS record, potentially with DNSSEC depending on the value of HAS_DIG.

Prior art: https://github.com/sesh/ready/commit/43988eebd8a14112be624babc741524797e8e886

drwetter commented 3 months ago

Thanks. Do you know of any hosts supporting those extensions?

Seirdy commented 3 months ago

seirdy.one (my domain) has supported these since Let's Encrypt first rolled out support to production servers.

dottedmag.eu/dottedmag.net does too, as does grapheneos.org.