Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Describe our remote VAs in Section 3.2.2 #263

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Describe our remote VAs in Section 3.2.2 #263

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c2b2f14
Describe our remote VAs in Section 3.2.2
aarongable Jan 13, 2025
706850f
Update CP-CPS.md
aarongable Jan 13, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CP-CPS.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,6 +230,8 @@ Prior to issuance of a Subscriber Certificate, ISRG uses at least one of the fol

Validation for Wildcard Domain Names is only performed using the DNS Change method.

All successful validations and CAA checks performed by our Primary Network Perspectives are corroborated by multiple Remote Network Perspectives located in at least two distinct Regional Internet Registries. Each Remote Network Perspective has an independent DNS resolver and cache.
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The initial DCV and CAA checks are verified from multiple network perspectives. However, CAA rechecks, which may occur just before finalization, are only validated from the primary perspective in Production. To fix this, we have two options: set EnforceMultiCAA to true in Production or set EnforceMPIC to true in Production. There’s a pending issue (IN-10875) to implement the latter change.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can also choose to not fix it, and instead massage the phrasing here, since the BRs allow single-perspective rechecks:

A CA MAY reuse corroborating evidence for CAA record quorum compliance for a maximum of 398 days.


All validations are performed in compliance with the current CAB Forum Baseline Requirements at the time of validation.

### 3.2.3 Authentication of individual identity
Expand Down
Loading