For CNAME records pointing to username.github.io, skip CAA check #108
Conversation
| # Must be a CNAME or point to our IPs. | ||
|
|
||
| # Only check the one domain if a CNAME. Don't check the parent domain. | ||
| return caa.lets_encrypt_allowed? if cname_to_github_user_domain? |
There was a problem hiding this comment.
| return caa.lets_encrypt_allowed? if cname_to_github_user_domain? | |
| return cname_to_github_user_domain? |
I don't think we even need to check the CAA record for the custom domain when it is a CNAME, as a CNAME can't co-exist with another record type.
This is why for example you can't use an CNAME at the apex of a domain, as it'd be co-existing with NS records at a minimum.
In this case, we only need to worry about CAA records when the custom domain is using A record(s), and can completely ignore CAA records when it is a CNAME once we have CAA records in place for *.github.io.
Ref: Section 3.6.2 in https://tools.ietf.org/html/rfc1034
Temporarily revert the site to plain HTTP since GitHub is having issues with checking CAA records for CNAME records. More details here: github/pages-health-check#108. This reverts commit 6db0db8.
| # Check CAA records for the full domain and its parent domain. | ||
| pointed_to_github_pages_ip? && | ||
| caa.lets_encrypt_allowed? && | ||
| caa.parent_domain_allows_lets_encrypt? |
There was a problem hiding this comment.
I don't think this will quite work in this form, as we should only fall back to the parent's CAA records if there are no CAA records for the custom domain itself.
There was a problem hiding this comment.
Thinking about this more, now that we are skipping CAA completely for the CNAME case, we could probably just restore the previous logic for the A record case, which handled this correctly.
|
Approving on the basis that we'll revert |
…y hostname doesn't have any CAA records
|
@snh updated. |
parkr
changed the title
This PR attempts to fix a bug in our CAA checking.
Example:
www.example.comis a CNAME toexample.github.io. Check only CAA onwww.example.com.foobar.example.comuses A records to point to GitHub Pages IPs. Check CAA forfoobar.example.comANDexample.com./cc @github/pages