You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Update CT section to include CAA and mandatory CT.
- For the question of limiting which CAs can issue, there is now a much
more responsive answer made possible by CAA.
- Split out CT into a separate question on how to monitor / detect
issuance.
- Update CT language to reflect that CT is now mandatory in Chrome for
new certificates.
Copy file name to clipboardExpand all lines: pages/certificates.md
+31-3Lines changed: 31 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -14,6 +14,7 @@ Frequently asked questions and answers about HTTPS certificates and certificate
14
14
*[Does the US government operate a publicly trusted certificate authority?](#does-the-us-government-operate-a-publicly-trusted-certificate-authority)
15
15
*[Are there federal restrictions on acceptable certificate authorities to use?](#are-there-federal-restrictions-on-acceptable-certificate-authorities-to-use)
16
16
*[Then how can I limit which CAs can issue certificates for a domain?](#then-how-can-i-limit-which-cas-can-issue-certificates-for-a-domain)
17
+
*[How can I find out when any certificate is issued for a domain?](#how-can–i–find-out-when-any-certificate–is-issued-for-a-domain)
17
18
18
19
## What are certificates and certificate authorities?
19
20
@@ -82,18 +83,45 @@ In practice, federal agencies use a wide variety of publicly trusted commercial
82
83
83
84
There is no simple and 100% effective way to force all browsers to only trust certificates for your domain that have been issued from a certain CA. In general, the strength of HTTPS on today's internet depends on the overall standards, competence, and accountability of the entire CA system.
84
85
85
-
However, domain owners can use **Certificate Transparency** to reduce the risk or impact of misissued or fraudulent certificates.
86
+
However, domain owners can use **DNS Certification Authority Authorization** to publish a list of approved CAs.
86
87
87
-
**[Certificate Transparency](https://en.wikipedia.org/wiki/Certificate_Transparency)** (CT) allows domain owners to **detect missuance of certificates after the fact**.
88
+
In addition, domain owners can use **Certificate Transparency** (see question below) to monitor and discover certificates issued by any CA.
89
+
90
+
**[DNS Certification Authority Authorization](https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization)** (CAA) allows domain owners to publish DNS records containing a list of the Certificate Authorities permitted to issue certificates for their domain.
91
+
92
+
All major CAs participate in CAA and promise to verify CAA DNS records before issuing certificates. Each CA should refuse to issue certificates for a domain name that publishes a CAA record that excludes the CA.
93
+
94
+
This is only a promise, so a non-compliant or compromised CA could still issue certificates for any domain name even in violation of CAA. But such mis-issuance would be more likely to be detected with CAA in place.
95
+
96
+
The standard DNS is not secure, so CAA records could be suppressed or spoofed by an attacker in a privileged network position unless DNSSEC is in use by the domain owner and validated by each CA issuer.
97
+
98
+
CAA can be paired with Certificate Transparency log monitoring to detect occurences of mis-issuance.
99
+
100
+
#### CAA Resources
101
+
102
+
*[Wikipedia entry](https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization) for CAA
103
+
*[RFC 6844](https://tools.ietf.org/html/rfc6844), the standard for CAA
104
+
*[CAA Record Generator](https://sslmate.com/caa/)
105
+
106
+
## How can I find out when any certificate is issued for a domain?
107
+
108
+
Domain owners can use **Certificate Transparency** to promptly discover any certificates issued for a domain, whether legitimate or fraudulent.
109
+
110
+
**[Certificate Transparency](https://en.wikipedia.org/wiki/Certificate_Transparency)** (CT) allows domain owners to **detect mis-issuance of certificates after the fact**.
88
111
89
112
CT allows CAs to publish some or all of the publicly trusted certificates that they issue to one or more public logs. Multiple organizations run CT logs, and it is possible to automatically monitor the logs for any certificates that are issued for any domains of interest.
90
113
91
114
Comodo has released an [open source](https://github.com/crtsh) Certificate Transparency log viewer that they operate at [crt.sh](https://crt.sh). For example, it is possible to see [all recent certificates for whitehouse.gov](https://crt.sh/?q=whitehouse.gov), and [details of specific certificates](https://crt.sh/?id=7976268).
92
115
93
-
The strength of Certificate Transparency increases as more CAs publish more certificates to public CT logs. Certificate Transparency is not currently a requirement for CAs -- however, as the use of CT increases, so does the viability of requiring CT for publicly issued certificates.
116
+
The strength of Certificate Transparency increases as more CAs publish more certificates to public CT logs. [Google Chrome requires Certificate Transparency for all new certificates](https://groups.google.com/a/chromium.org/forum/#!msg/ct-policy/wHILiYf31DE/iMFmpMEkAQAJ) issued after 30 April 2018. As a result, most CAs now submit new certificates to CT logs by default.
117
+
118
+
However, a CA may still issue new certificates without disclosing them to a CT log. These certificates will not be trusted by Chrome but they may be trusted by other browsers.
119
+
120
+
Chrome also exempts private CAs from the transparency rules, so private CAs that do not chain up to any public root may still issue certificates without submitting them to CT logs.
0 commit comments