Certificate Authority Authorization Checking: What is it, and why should you care?
Certificate Authority Authorization checking: what is it, and why should you care?
The Public Key Infrastructure (PKI) ecosystem relies on root certificates issued by various certification authorities (CAs) like Symantec. This is what browsers use to decide which websites can be trusted, and which ones are not trusted.
Up to now, any CA can issue a TLS certificate for any domain. That’s how the system works, and it’s good in the sense that it gives website owners and operators options to change CAs at their discretion. The downside to this is that certificate issuance can happen without the knowledge of website operators, either by mistake or intentionally by malicious actors.
A number of technologies have been created in an attempt to highlight instances of “unknown” issuance, such as Certificate Transparency. These have been effective in making the internet a safer, more trustworthy place but they are reactionary measures – only .allowing website operators to address the issue after it’s happened.
But is it possible to prevent certificates from being mistakenly or inappropriately issued? Yes. Enter: Certification Authority Authorization (CAA).
CAA prevents unknown certificate issuance by:
1.Allowing domain owners to specify which CAs are authorized to issue certificates for their domains; and
2.Giving CAs the ability to check this authorization before issuing a certificate.
In this article, we’ll explain how CAA works, and why making CAA checking mandatory is a good move for both customers and CAs.
What is Certification Authority Authorization?
A Certification Authority Authorization (CAA) record is a DNS Resource Record which allows a domain owner to specify which CAs are authorized to issue certificates for their domain(s) and, by implication, which aren’t.
The idea is that a CA will check the CAA record(s) for a domain before issuing a certificate. If it finds that a domain has no CAA record, then it’s free to issue a certificate for it if all other authentication checks succeed. However, if it does encounter one or more CAA records, then the CA can only issue a certificate if it’s named in one of the records, indicating that it is authorized to issue a certificate for that domain. The whole process is designed to prevent CAs from unauthorized certificate issuance requests by unauthorized parties or bad actors.
Sounds great. Why isn’t everyone doing this?
Symantec has been checking CAA records for years, but it’s not a common practice. There are two reasons why CAA checking isn’t widely practiced:
1.Many domains don’t have a CAA Resource Record; and
2.Checking CAA records is not mandatory.
Because it may take some work to create a CAA record, it’s a matter of customers or website operators consciously opting-in, not opting-out. Many domain owners use a DNS hosting provider and CAA is not yet supported in some DNS implementations.
This is why CAA records are expected to be used by most high-value domains. These enterprises keep CAA records for their domains because they limit inappropriate (or malicious) certificate requests, and makes it easier to enforce company policies i.e. only using a particular set of CAs.
The limitations of CAA checking
Of course, CAA checking has its limitations.
First, a newly-issued CAA record does not invalidate any previously-issued certificates that may have been issued by a different CA than the one named by the domain owner. Second, it doesn’t flag whether a certificate presented by a web server is a legitimate certificate for that domain.
Furthermore, in order for CAA checking to be effective, all CAs need to be doing it; it doesn’t work if only one or two CAs are checking CAA records as matter of process. CAA checking must be widely adopted if it is to serve its purpose, but the good news is that more than ninety percent of CAs (who are members of the CA/Browser Forum) are in favor of it.
The times are changing: CAA checking will become mandatory
In February 2017, the CA/Browser Forum passed a ballot (on which Symantec voted in favor) requiring all CAs (even those who aren’t a member of the Forum) to check for a CAA record as part of the certificate issuance process for each domain. In accordance with RFC 6844, CAs can no longer issue a certificate for a domain unless:
1.The CA does not find any CAA records for the domain
2.The certificate request is consistent with the applicable CAA Resource Record(s)
The rule is effective as of 8 September 2017. You can read the ballot in full here.
A good outcome for all companies
Mandatory CAA record checking requires CAs to abide by the rules set out in specific CAA records, giving domain owners more control over certificate issuance. This makes it easier for companies (especially larger ones) to enforce a certificate issuance policy across business units. With CAA records applicable to every domain, a company can specify a set number of CAs, knowing no other CA can issue a certificate to its domains. This will help reduce the risks of certificate issuance by unauthorized CAs and help create a more secure and transparent online ecosystem.
For more information on CAA with Symantec Certificates go to Symantec Knowledge Center
from ransomware-malware-blade http://ift.tt/2vs7aWm
via Specialisti Securitate IT in Cluj-Napoca, Romania
Comentarii
Trimiteți un comentariu