Certificate Authority Authorization to secure certificate delivery

[smerle33]

Service(s)

Other

Summary

In order to add security to certificate delivery we should ensure that we got a domain CAA record as per https://letsencrypt.org/docs/caa/

Reproduction steps

https://caatest.co.uk/jenkins.io

[timja]

Be careful with this and make sure all places that could issue certificates are covered.

i.e. repo.jenkins-ci.org (not sure if any others don't use let's encrypt)

[dduportal]

As per https://sslmate.com/caa/ + https://www.certificate-transparency.org/:

• jenkins.io uses certificates delivered by "amazon.com", "globalsign.com" and "letsencrypt.org"
• jenkins-ci.org uses certificates delivered by "amazon.com", "godaddy.com" and "letsencrypt.org"
• jenkinsistheway.io uses certificates deliverez by "godaddy.com" and "letsencrypt.org"

The CAA records to be created (with a minimal TTL):

| Name               | Type   | Value                       |
|--------------------|--------|-----------------------------|
| jenkins.io.        | CAA    | 0 issue "amazon.com"        |
|                    |        | 0 issue "globalsign.com"    |
|                    |        | 0 issue "letsencrypt.org"   |
|                    |        | 0 issue "godaddy.com"       |
| -------------      | ------ | --------------------------- |
| jenkins-ci.org.    | CAA    | 0 issue "amazon.com"        |
|                    |        | 0 issue "globalsign.com"    |
|                    |        | 0 issue "letsencrypt.org"   |
|                    |        | 0 issue "godaddy.com"       |
| -------------      | ------ | --------------------------- |
| jenkinsistheway.io | CAA    | 0 issue "amazon.com"        |
|                    |        | 0 issue "globalsign.com"    |
|                    |        | 0 issue "letsencrypt.org"   |
|                    |        | 0 issue "godaddy.com"       |

[dduportal]

Ping @Wadeck @daniel-beck @MarkEWaite @timja does it looks good to you?

[Wadeck]

Not enough DNS expert to reply :)

[dduportal]

Done:

• https://caatest.co.uk/jenkins.io:

✔ All looks good
---
0 issue "amazon.com"
0 issue "globalsign.com"
0 issue "letsencrypt.org"
0 issue "godaddy.com"

• https://caatest.co.uk/jenkins-ci.org:

✔ All looks good
---
0 issue "amazon.com"
0 issue "globalsign.com"
0 issue "letsencrypt.org"
0 issue "godaddy.com"

• https://caatest.co.uk/jenkinsistheway.io:

✔ All looks good
---
0 issue "amazon.com"
0 issue "globalsign.com"
0 issue "letsencrypt.org"
0 issue "godaddy.com"