[Errata Held for Document Update] RFC6844 (5244)

The following errata report has been held for document update 
for RFC6844, "DNS Certification Authority Authorization (CAA) Resource Record". 

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5244

--------------------------------------
Status: Held for Document Update
Type: Technical

Reported by: Corey Bonnell <[email protected]>
Date Reported: 2018-01-26
Held by: EKR (IESG)

Section: 5.2

Original Text
-------------
CAA authorizations are additive; thus, the result of specifying both
the empty issuer and a specified issuer is the same as specifying
just the specified issuer alone.

Corrected Text
--------------
CAA authorizations are additive; thus, the result of specifying both
the empty issuer and a specified issuer is the same as specifying
just the specified issuer alone.  A non-empty CAA record set that does
not contain an issue property tag is authorization to any certificate
issuer to issue for the corresponding domain, provided that no
records in the CAA record set otherwise prohibit issuance.

Notes
-----
The current wording in the RFC does not clearly state how non-empty CAA record sets which do not contain any "issue" property tags should be handled in terms of whether or not such record sets authorize issuance. The additional wording clarifies the correct handling of this case.

--------------------------------------
RFC6844 (draft-ietf-pkix-caa-15)
--------------------------------------
Title               : DNS Certification Authority Authorization (CAA) Resource Record
Publication Date    : January 2013
Author(s)           : P. Hallam-Baker, R. Stradling
Category            : PROPOSED STANDARD
Source              : Public-Key Infrastructure (X.509)
Area                : Security
Stream              : IETF
Verifying Party     : IESG

_______________________________________________
pkix mailing list
[email protected]
https://www.ietf.org/mailman/listinfo/pkix