CAA Records: An Alternative to DANE for Protecting SSL/TLS Certificate Users
By Joe St. Sauver
I. Introduction
One of the oddities of the SSL/TLS certificate ecosystem is that there are many broadly-trusted Certificate Authorities (CAs), and EACH of those CAs (technically) has the ability to issue a trusted certificate for ANY domain.
Moreover, the mere fact that one CA may have already issued a certificate for a given domain DOESN'T prevent a second CA from also issuing a certificate for that SAME domain!
This sort of trusted-certificates-from-multiple-providers scenario can legitimately arise when a site changes from one CA to another.
However, wrong certs have been mis-issued by accident, and from time-to-time the bad guys have also figured out ways to get certificates for domains they don't legitimately control. Certificate authorities go to great lengths to ensure that this rarely happens, but even just the possibility that this could potentially occur is still worrisome.
You'd really like to have the ability to say, 'Hey, my domain ONLY obtains certificates from CA "Foo." If you see a certificate for this domain from some OTHER provider, that CA is NOT one we use, so don't trust it!'
There are now two main approaches, both DNS-based, that you can use to try to protect your domains from mis-issued certs: DANE and CAA.
Let's consider DANE first.
II. DANE ("DNS-Based Authentication of Named Entities")
DNSSEC was originally created as a way to prevent cache-poisoning and related attacks against the domain name system.
DNSSEC creates a cryptographically-signed trust hierarchy that flows from the
root domain (.
) down through top-level domains (such as .com
), on
through 2nd-level domains (such as example.com
) to individual fully qualified
domain names (such as www.example.com
). When resolving a DNSSEC-signed
domain name, the results that are received get checked to ensure that they
cryptographically validate.
That DNSSEC trust hierarchy also creates an alternative trust hierarchy for SSL/TLS certificates: DANE.
DANE can be used both as potential alternative to traditional commercial CAs, OR as a way of confirming the commercial certificate authority/the commercial certificate that a site is using. See the usage modes as described here.
Unfortunately, using DANE means that a site needs to DNSSEC-sign their zone. DNSSEC deployment has seen limited uptake to-date. For example, in the ISOC report "State of DNSSEC Deployment 2016", ISOC reports that only about 0.5 percent (1/2 of 1%) of all dot com zones are DNSSEC-signed.
The number of sites that are publishing TLSA records (needed to do DANE) is even smaller. We can check Farsight Security's passive DNS database, DNSDB, for https TLSA records for the default https port (443/TCP) by saying:
$ dnsdb_query.py -r _443._tcp.\*/TLSA -l 1000000 > _443._tcp.txt
Our output will be in "_443._tcp.txt". We can clean up that file by deleting comment lines (lines containing the literal string ";;") and blank lines by using vim (or some other preferred editor). Having done so, at the time this article was prepared, we're left with just 304 TLSA records. That's not very many.
If we reduce those records to just unique effective 2nd-level domains, we take the count of unique TLSA records down even further, to just 145 unique effective 2nd-level domains:
$ awk '{print $1}' < _443._tcp.txt | 2nd-level-dom | sort -u | wc -l 145
That's REALLY not very many. A list of these domains is attached as Appendix I. [If there are domains that are publishing TLSA domains for 443/TCP that we've missed, we'd love to hear about them.]
The other factor limiting the impact of DANE is "end-user visibility." Even if sites publish TLSA records, without a 3rd-party browser extension, most browsers won't actually check and validate a domain's DANE status. This means that even if a domain is secured with DANE, without a validating browser extension installed, you'd never know it. More significantly, if a domain is secured with DANE and you bump into someone's who's "trying something fishy," without a browser extension installed you'd not know THAT, either! Clearly, browser extensions providing end-user visibility play an important role in making DANE operationally meaningful. If you'd like to add DANE validation support to the browser you use, see Mr. Shumon Huque's excellent article. It does a very nice job of explaining how to go about adding a DANE validation extension to Firefox.
III. The Alternative to DANE: Certification Authority Authorization (CAA) Resource Records
Since DANE has not been very broadly adopted as a way of "nailing down" the CA that a site actually uses, an alternative has been developed, the CAA record as defined in RFC6844.
Checking for CAA records by broadly trusted CAs has been adopted as mandatory, effective 8 September 2017, per CAB Forum ballot. This means that if a CAA record exists for a domain, any broadly trusted CA approached to issue a certificate for that domain must check and honor the constraints imposed by a CAA record, if defined. If no CAA record exists, normal certificate issuance procedures will be followed.
We checked the June 2017 DNSDB Export data (271,530,170,657 octets) to see if we could find any CAA records. We did that with the commands:
$ dnstable_dump -r /export/dnstable/mtbl/dns.201706.M.mtbl | rg -i " CAA " > caa.txt
The "ripgrep" tool (rg) used in the above pipeline is available here.
We condensed that output to just the effective 2nd-level domains by saying:
$ awk '{print $1}' < caa.txt | 2nd-level-dom | sort -u > caa-doms-only.txt
There were 418 domains which had one or more CAA records defined. A copy of those domains can be found in Appendix II. Again, this is not a lot of domains right now, but we expect that this number will grow over time.
We took those domains and performed a "dig" (limited to just CAA records) for each such domain.
Looking at just the "issue" records, the nine most popular CAs were:
181 letsencrypt.org 72 comodoca.com 68 digicert.com 25 geotrust.com 22 symantec.com 18 globalsign.com 10 thawte.com 8 rapidssl.com 7 godaddy.com
No other CA had half a dozen or more "issue" CAA records during June 2017.
Looking at just the "issuewild" records, the only CAs with half a dozen or more "issuewild" records were:
24 "comodoca.com" 9 "digicert.com" 7 "geotrust.com"
Looking at just the iodef records, there was no email (or web) entry associated with 6 or more CAA records.
We also checked the flag value in the CAA records. Normally the flag will either be set to 0 (not critical) or 128 (critical), but we also saw a few 1s and 5s:
Count Value 416 0 37 128 8 1 2 5
IV. What This All Means and More Information
Neither DANE nor CAA is seeing much adoption and use so far, but we're just getting started. Hopefully DANE and/or CAA records will soon be a part of everyone's domain configuration!
For more information about obtaining access to DNSDB or any Farsight product, please see our services page.
Appendix I. Effective 2nd-Level-Domains With TLSA records Known to DNSDB
3a52ce780950d4d969792a2559cd519d7ee8c727.org aegee.org aha-it.ch aibor.de alessandroz.pro andrumx.com atns.de autistici.org bishnet.net calyx.net cdom.de cheetah85.eu concentrade.de couturat.fr cryptech.is cvut.cz cypherpunks.ru debian.org defcon.org deghe.io desec.io diasp.org directbox.com dns-oarc.net dnssec-tools.org dnssec-validator.cz dominion.ch dougbarton.us drupal-mode.info eclipse.id.au egaspar.pro faui2k12.de fedoraproject.org fobos.de freebsd.org freenetproject.org fsinf.at genua.fr getdnsapi.net gragnottes.fr hacklab.to had-pilot.biz hd.se heypete.com huque.com identitysec.com inter-september.at interaffairs.com isc.org itverx.com.ve j3e.de jabber.at jabber.wien jelmer.uk joergschneider.com jrg.systems jskeo.com k-ict.org kabelmail.de karatsbichl.com kd2.io keepassx.org killian.com kroesen.de krude.de kumari.net labbrack.se laquadrature.net leterbe.com litts.net logosengineering.com lopez-cloud.de lundogbendsen.dk magneds.com mailbox.org miwu.net modum.by mtexx.com nevadafiber.net nic.cz nic.fr nlnetlabs.nl nohats.ca nomagic.fr o2r.fr oakes.me.uk octopuce.fr open-to-repair.fr os3sec.org peeters.io plattnerplace.us posteo.de q3q.us qnixsoft.com qualys.network rasalf.pw richlj.eu ripe.net rop.io samba.org sathanas.de schrimpe.de securemail-wshs.de shareworx.net shevaldin.ru sidnlabs.nl simplednscrypt.org skilpa.net smile.de spdysync.com ssl-tools.net st-mail.net starka.st stratum0.net suchat.org syngenuity.com t0biii.de t37.net team666.fr telbiur.com.pl theshape.eu timo-wingender.de tlakh.xyz tltms.de toppoint.de torproject.org trex.fi ttodd.com tutanota.com tutanota.de unitymedia.de usp.br valvisio-secure.de vaucher.org verisignlabs.com weltweit-gamma.eu winpack.cf wo2forum.nl worldlist.org xacl.org xn--rrc-wrfel-u9a.dk xs-net.de ze3kr.com zijlstra-automatisering.nl zx.com
Appendix II. Effective 2nd-Level Domains With One or More CAA Records
1c.link 2scale.net 3dnews.ru 3storysoftware.com 4ty.gr 6550101.ru abouthistory.ml accra.ca actionlabs.net adblockextreme.net adblockextreme.org adderall.space aerisnetwork.com afraid.org akavita.com allen.org.za alojalia.com altarisnine.com altstu.ru am1470.com amgresources.com andovercos.com anm.gov.my appspot.com apsiyon.com archi.fr arlet.click artyland.ru asianlegend.ca astralnalog.ru athenium.com ati.su atlantis.sk atolm.net au.edu.tw azbyka.ru balkaniyum.tv baseciq.org bbn.de bcit.ca beauty24.de benefitoutsourcing.com billaud.eu.org blberza.com bmm.com.tr boatcruises.com borntobooze.com bramvanaken.be bsdly.net bum.org caddyserver.com cashcall.com cashcallmortgage.com catsbats.org ccrek.be ccu.plus cdn6.de centos.org charite.de citilink.ru clearjay.com close.com cmail19.com cmail1.com cmail20.com cmail2.com cmail3.com cmail4.com cmail5.com cmkos.cz coloradomesa.edu comodo.com concordma.gov constabel-it.de controldecuenta.com convokesystems.com corvair.org covestor.com cpanel.com crashsec.com crayons.com.au createsend1.com createsend3.com createsend4.com createsend5.com cruzio.com culvers.com cuone.org custhelp.com cyh.com.tr daladubbeln.se depechemode-live.com deskspb.ru divegearexpress.com dm.agency dns-api.com drv.de duhamel.ws e2e4online.ru eastspring.com.tw eaton-works.com ecam.fr ecivis.com edwards.me.uk elektro-breitling.de elemental.org eleprintsa.com.ar emakina.com ender-m.at e-norvik.lv epidauros.be erdgeist.org evangel.edu execuchoice.com fedoraproject.org felsing.net fenerbahce.com.tr filopto.com fission.com flow.su fpunet.com fu-berlin.de galtier.me gamblers.casino garagemhermetica.org gaugusch.at generali.ro geneseeisd.org gentoo.org getfedora.org ghaglund.se giannakazakou.gr gibertjoseph.com glasgestaltung.biz gmu.edu goipv6.hk good-solutions.ch google.com googleusercontent.com gothic.net.au grepular.com griaudio.ru guap.ru gyas.nl ha.com hamradio.pl hansvaneijsden.com haplo.org hboeck.de hbu.edu headgear.org hentai.design hinata.co.za hkdnr.hk hkirc.hk hkst.com hldns.com home-v.ind.in honigman.com hookahmarket.ru hs-mannheim.de hsntech.com hudson.com humanasset.net hur.st hv.se hypotheca.ca idnet.com ihc.ru i-med.ac.at imirhil.fr imsweb.com insomniagamingfestival.com intelius.com inwx.net ip6.li ip.com ipdynamics.de irfu.se isracard.co.il i-teco.ru jb.org jeffco.k12.co.us jku.at jobisjob.co.uk joksch.info joomlapolis.com karloluiten.nl kartoteka.by ke2.io kk7.ch kooky.org ksh-linux.info kurbits.tech kyhwana.org kylelaker.com la-evento.com lavteam.org levigo.de levittgoodmanarchitects.com liquida.it loanme.com luceed.hr lynx.bc.ca madbavarian.org madderragroup.com mahono.com markusehrlicher.de math.ca matteomarescotti.it mcarrillo.co mcdonaldhopkins.com mcn.org medfusion.com medfusion.net mentor.pl mhbh.com microtekcorporation.com migrosbank.ch minkult.com missouricom.com mkb.ru mobydog.net mojapraca.sk monitman.solutions mtc.md myownconference.ru myspacebox.net mysubwaycard.com nails.eu.org naturalworld.ru neio.uk netbasics.nl netsite.dk nevz.com newpaltz.edu nfoservers.com niagararegion.ca nic.hu nic.ua niklas.pw nodo50.org nolo.io noorbank.com nopremium.pl nordea.ru nort.io nsk.su obscuredfiles.com oktetlabs.ru onlime.ru openhireresumes.com orange.de ort.edu.uy pandora.be pari.edu parks.on.ca pasarella.eu paulhastings.com paulhastingsllp.com paypc.com pcca.com perspectives.org pojistovnacs.cz polischuk.org posteo.de premiumfunding.net.au provu.co.uk pstatic.net psychedeli.cat qcom.it quickrelief.hk rabota.ua radiogothic.net raovatmienphi.org refer.io reintechnik.at remote.net rhymeswithmogul.com rightnow.com rio2016.com rockauto.com roe.ch rojan.net rootforum.org rpavlik.cz rruq.ca samba.org sarafanka.com savbb.sk sb.by sccu.com.au scottsboro.org secure-computing.net securycast.com seek.com.au seek.co.nz sefic.name semenov.su semplicita.eu service-now.com seuffer.de sevensages.org showgroup.com.au silkroad.com silkroadtech.com skatteverket.se slevomat.cz slickdeals.net smartftp.net smsv.com.ar socionet.ru softcom.net sorincocorada.ro spamwc.de spdf.net speedy.it sro.vic.gov.au stateheritage.wa.gov.au steadfast.net storm.ca st-projects.com structuralia.ro stulda.cz suai.ru suche.org sunyrockland.edu survivalpuck.com suzuki-motor.ru symantec.com syspro.com tampaelectric.com teamclassified.ca tecoenergy.com telehouse.bg telenet.be telenet-ops.be televes.shop telmex.com tensquaregames.com thefacebook.com theiapolis.com theory.org therevenge.me thinkindifferent.net tiendeo.mx tihlde.org tjsheds.com.au tobias-kluge.de tomsoft.hr tonyrobbins.com toptropicals.com tradeville.eu tranchant.co.uk treebaglia.xyz treehouse.org.za troianet.com.br truelite.it ttf.hr uah.es uatlantica.pt uc3m.es ue.poznan.pl ufs-online.ru ugcdn.com ultrabill.net ulttk.ru unfcu.com uni-berlin.de unice.fr unido.org unileoben.ac.at uni-rostock.de uni-sofia.bg univ-tlse1.fr unlp.edu.ar uralmash.ru urjc.es uta.fi ut-capitole.fr utc.fr utu.fi uvic.cat vdorst.com vfemail.net videoculinary.ru viemeister.com vminnovations.com vnx.me voyager.hr vpsforex.ru vrn.ru vsb.cz wallawalla.edu wangqiliang.com weddingwire.com wesasoft.at whitecliffodover.net wideband.net.au wimbo.nl wo2forum.nl wolfemg.com wowhull.com wrede.ca wsprings.com wsrcc.com xcx.cc xn--06qz4d21e1w4a175akjt.xn--j6w193g xn--06qz4d21eoy3e.xn--j6w193g xn--blq35e5y3ddkclsr.xn--j6w193g xn--blq35eru2b4ynehd87sxlz.xn--j6w193g xn--fhqt35f07ipwo.xn--j6w193g xn--tigreray-i1a.org xynex.us z0p.org zamg.ac.at zeoplus.com ziroh.be
Joe St Sauver, Ph.D. is a Scientist with Farsight Security, Inc.