Add verifier for CAA records

kelunik / acme

Async ACME library written in PHP based on the Amp concurrency framework.

MIT License

121 stars 19 forks source link

Add verifier for CAA records #30

Open kelunik opened 6 years ago

kelunik commented 6 years ago

CAA records are now enforced and issue attempts which are blocked due to CAA give an unhelpful error message currently. A CAA validator should be added to catch such errors early and provide helpful error messages.

cpu commented 6 years ago

@kelunik The idea of validating CAA ahead of time is a good idea :+1: I also wanted to mention that when you POST an authorization's challenge and it fails because of a CAA record that doesn't allow issuance you should get back a problem document in the response that has a clear detail message that can be echoed to the user. Something like "CAA record for example.com prevents issuance".

kelunik commented 6 years ago

Wasn't sure what ACME currently reports, but a self-verify like for challenges can be useful anyway.