Subject: [pkix] Protocol Action: 'DNS Certification Authority Authorization (CAA) Resource Record' to Proposed Standard (draft-ietf-pkix-caa-15.txt)

From: The IESG <[email-masked]>
Date: Mon, 26 Nov 2012 13:36:08 -0800

The IESG has approved the following document:
- 'DNS Certification Authority Authorization (CAA) Resource Record'
  (draft-ietf-pkix-caa-15.txt) as Proposed Standard

This document is the product of the Public-Key Infrastructure (X.509)
Working Group.

The IESG contact persons are Sean Turner and Stephen Farrell.

A URL of this Internet Draft is:
http://datatracker.ietf.org/doc/draft-ietf-pkix-caa/

Technical Summary

The Certification Authority Authorization (CAA) DNS Resource Record
allows a DNS domain name holder to specify one or more Certification
Authorities authorized to issue certificates for that domain. CAA
resource records allow a public Certification Authority to implement
additional controls to reduce the risk of unintended certificate mis-issue.

Working Group Summary

This document might have been pursued in other WGs, specifically
DNSEXT, since it specifies a new DNS record type. It also might have
been pursued in DANE, but the focus of DANE is sufficiently different
that it is probably not a good fit there. Because the document specifies
a DNS record type, for use with PKI technology, PKIX was reasonable
choice for the authors. There was some controversy initially, but that
went away over time.

Document Quality

I am not aware of any existing implementations of the protocol, but
both authors work for a company that is represented by a trust anchor in
browsers and operating systems, and thus it is likely that their
organization will support this proposal via an implementation.

Personnel

Steve Kent is the Document Shepherd.
Sean Turner the Responsible Area Director.

---

From: "Manger, James H" <[email-masked]>
Date: Tue, 27 Nov 2012 22:51:07 +1100

draft-ietf-pkix-caa-15 (which seems to have just been approved) still has an unfixed technical typo:

Section 3 "The CAA RR type" lists the 3 property tags that are defined. The second should be "issuewild", but is listed as "issue".

WRONG
   issue <Issuer Domain Name> [; <tag=value> ]* :  The issue property
      entry authorizes the holder of the domain name <Issuer Domain
      Name> or a party acting under the explicit authority of the holder
      of that domain name to issue wildcard certificates for the domain
      in which the property is published.

RIGHT
   issuewild <Issuer Domain Name> [; <tag=value> ]* :  The issuewild property
      entry authorizes the holder of the domain name <Issuer Domain
      Name> or a party acting under the explicit authority of the holder
      of that domain name to issue wildcard certificates for the domain
      in which the property is published.

--
James Manger

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> The IESG
> Sent: Tuesday, 27 November 2012 8:36 AM
> To: IETF-Announce
> Cc: pkix mailing list; pkix chair; RFC Editor
> Subject: [pkix] Protocol Action: 'DNS Certification Authority
> Authorization (CAA) Resource Record' to Proposed Standard (draft-ietf-
> pkix-caa-15.txt)
> 
> _______________________________________________
> pkix mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pkix

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 27 Nov 2012 10:59:18 -0500

Yes, I will fix this and a couple of other typos.

On Tue, Nov 27, 2012 at 6:51 AM, Manger, James H <
[email-masked]> wrote:

> Section 3 "The CAA RR type" lists the 3 property tags that are defined.
> The second should be "issuewild", but is listed as "issue".
>
> WRONG

-- 
Website: http://hallambaker.com/

---

From: Sean Turner <[email-masked]>
Date: Tue, 27 Nov 2012 13:16:06 -0500

I got it updated to:

http://www.rfc-editor.org/errata_search.php?rfc=2560&eid=3417

spt