|
|
|
|
|
by tialaramex
3511 days ago
|
|
No. CAA is an instruction to Certificate Authorities, not an instruction to clients. Let's Encrypt obeys CAA, if you try to validate for a domain which has a CAA record saying e.g. "Only Symantec may issue for this domain", Let's Encrypt's software will reject the validation. Current Baseline Requirements don't require this of a CA (they're required to document what they do with CAA but most picked "soft fail" ie they will issue but maybe do extra scrutiny) because they feared it would be used somehow in an anti-competitive way. Client software like Firefox, or Internet Explorer, ignores CAA altogether, as described in the design of CAA. |
|