[Feature request] DNS CAA records: support checking for Extensions for Account URI and ACME Method Binding (RFC 8657)

[Seirdy]

Which version are you referring to

3.2rc3, Using "OpenSSL 3.1.1 30 May 2023 (Library: OpenSSL 3.1.1 30 May 2023)" [~94 ciphers]

Describe your feature request (if it's a technical feature)

testssl.sh currently checks for CAA records. It doesn't check or validate RFC 8657's extensions for account and method binding, which restrict who can request certificates and how.

Describe the solution you'd like

testssl.sh can check for and validate the accounturi and validationmethods parameters of a CAA DNS record, potentially with DNSSEC depending on the value of HAS_DIG.

Prior art: sesh/ready@43988ee

[drwetter]

Thanks. Do you know of any hosts supporting those extensions?

[Seirdy]

seirdy.one (my domain) has supported these since Let's Encrypt first rolled out support to production servers.

dottedmag.eu/dottedmag.net does too, as does grapheneos.org.