What's the ideal way to handle SSL Subject Alternative Names in a CAA record?

By -

Suppose I want to request an SSL certificate from "Example CA" with the following domain names on it:

  • Subject Name: foocorp.com
  • Subject Alt Name: www.foocorp.com
  • Subject Alt Name: images.foocorp.com
  • Subject Alt Name: foocorp.net
  • Subject Alt Name: *.foocorp.net
  • Subject Alt Name: foocorp.biz
  • Subject Alt Name: *.foocorp.biz

If I wanted to implement CAA for this certificate, I could see a few ways to construct the DNS records to permit issuance. But it's not immediately clear if each method will work correctly for each domain. Here are the variants I've considered, and my thinking for each.

#1: Only implement the record for the domain listed as the Subject Name. If that's all the CA checks, that's all we need:

foocorp.com.    IN    CAA    0 issue "ca.example.com"

I have a sneaking suspicion that this won't work, and we have to add CAA records to everything listed in the SAN list for the certificate to be issued. If that's indeed the case, I suppose this won't work.

#2: List each domain as wild, and don't worry about any of the subdomains:

foocorp.com.    IN    CAA    0 issuewild "ca.example.com"
foocorp.net.    IN    CAA    0 issuewild "ca.example.com"
foocorp.biz.    IN    CAA    0 issuewild "ca.example.com"

This feels like the simplest approach that could work, although I'm not sure if I would have to re-specify any records using issue to allow issuance to the apex domains.

#3: Meticulously match the CAA records with the structure of the certificate:

foocorp.com.           IN    CAA    0 issue "ca.example.com"
www.foocorp.com.       IN    CAA    0 issue "ca.example.com"
images.foocorp.com.    IN    CAA    0 issue "ca.example.com"
foocorp.net.           IN    CAA    0 issue "ca.example.com"
foocorp.net.           IN    CAA    0 issuewild "ca.example.com"
foocorp.biz.           IN    CAA    0 issue "ca.example.com"
foocorp.biz.           IN    CAA    0 issuewild "ca.example.com"

This seems like a real pain in the butt to manage. As with option #2, it's not clear to me if issue+issuewild is over-specified and we could make do with keeping only one of them.

What's the best way to construct the CAA records for this situation?



from Recent Questions - Stack Overflow https://ift.tt/3dPmG3s
https://ift.tt/eA8V8J

Comments

Post a Comment

Popular posts from this blog

Today Walkin 14th-Sept

By -
Image
14th Sept 2017 ( GO Through all List) Read Walkin details properly , Try to call company before attending if possible !!! ==================================== 1. Myntra through fresherworld (Call Based , Venue shared to shortlisted candidates) _____________________________ 2. Magna : Hiring for Client Harman : C++
Read more

Hibernate Search - Elasticsearch with JSON manipulation

By -
Elasticsearch with JSON manipulation Elasticsearch ships with many features. It is possible that at some point, one feature you need will not be exposed by the Search DSL. To work around such limitations, Hibernate Search provides ways to: Transform the HTTP request sent to Elasticsearch for search queries. Read the raw JSON of the HTTP response received from Elasticsearch for search queries. Direct changes to the HTTP request may conflict with Hibernate Search features and be supported differently by different versions of Elasticsearch. Similarly, the content of the HTTP response may change depending on the version of Elasticsearch, depending on which Hibernate Search features are used, and even depending on how Hibernate Search features are implemented. Thus, features relying on direct access to HTTP requests or responses cannot be guaranteed to continue to work when upgrading Hibernate Search, even for micro upgrades (x.y.z to x.y.(z+1)). Use this at your own risk.
Read more

Spring Elasticsearch Operations

By -
Elasticsearch Operations Spring Data Elasticsearch uses two interfaces to define the operations that can be called against an Elasticsearch index. These are ElasticsearchOperations and ReactiveElasticsearchOperations. Whereas the first is used with the classic synchronous implementations, the second one uses reactive infrastructure. The default implementations of the interfaces offer: Read/Write mapping support for domain types. A rich query and criteria api. Resource management and Exception translation. ElasticsearchTemplate The ElasticsearchTemplate is an implementation of the ElasticsearchOperations interface using the Transport Client. @Configuration public class TransportClientConfig extends ElasticsearchConfigurationSupport {   @Bean   public Client elasticsearchClient() throws UnknownHostException {                      Settings settings = Settings.builder().put("cluster.name", "elasticsearch").build();     TransportClient client = new P
Read more