We conduct controlled experiments to analyze whether CAs hone the CAA record that has come into effect on September 8, 2017.

We conduct 1 round of tests right at CAA record effectiveness (around September 9), and a round of re-tests a month later (October 10th).

UPDATE 2017-11-23: We have identified issuance anomalies based on historic DNS records Link

UPDATE 2017-11-15: DigiCert has done an extense review of our test case D2, and even identified 4 new certificates affected by the same problem. Bugzilla

We set up several test domains to check various corner cases of CAA deployment.
This list has some overlap with the nice work at https://caatestsuite.com/

Zone files can be found under zonefiles/.

For case D4, RFC and CAB Ballot permit a CA to issue. However, CAs may (and maybe should) be more conservative and decide to refuse to issue after a timeout no the CAA record.

[1] More explanation on D2: The zonefile contains an "issue ;" CAA record, and all CAA replies for that zone are dropped. As the zone is signed, even in case of a non-dropped reply, no CA would be authorized to issue.

The table header contains the expected result.

The first result indicates the result of the first test in September 2017, the second result the re-test in October 2017.

For example (Refused/Issued) indicates that a CA refused to issue in the first test in September, but issued in the re-test in October.

[1] Other Symantec brands with same backend as RapidSSL not tested individually. FIrst refusal might have been due to missing locality in CSR, we validated second-round CSRs using this checker

[2] First test for D4 cancelled after 2 days in pending, likely in wake of our bug report for D2.

[3] Due to the high cost of certificates and lengthy validation process, we only tested the basic case for DigiCert and Network Solutions.

[4] Comodo instantly reacted to our report and changed their system behaviour. An immediate re-test led to issuance 2 days later. Comodo then stated that they had to revert back to the old behavior for operational reasons.

[5] Though SSL.com delivers Comodo certificates and uses the comodo backend, its observable behaviour differed.

Discussion on D2

Comodo First Round Bug Report

We will update this page as more information becomes available. You are very welcome to contact us through email/phone as listed on https://www.net.in.tum.de/members/scheitle/

Further information and opt-out contacts are given under https://net.in.tum.de/projects/gino/

RapidSSL/GeoTrust/Symantec/Thawte Trial Certificates

Comodo 1 2

Certum

CSR checker

Mozilla NSS Mis-Issuance Bugtracker

Mozilla CA contacts

SSL.com revoke mechanism