3

After five months of no problems nor errors with my Comodo certificate on a personal website suddenly, as of two or three days ago, I'm getting a meddlesome, "Certificate isn't from a trusted authority," error when viewing on my Android mobile. (No errors appear when viewing on desktop, neither when the website is viewed on a friend's iPhone.)

In trying to solve, I'd run ssllabs.com on it. All results green, but for an orange 'DNS CAA' returning 'No'.

Does anyone know what 'DNS CAA' is? I visited Qualys' blog for further information, but didn't fully understand. Plus, it seemed they said those DNS CAA changes happened in 2017, so I also don't understand why I'd suddenly have errors now when it was working before (I'd signed up for the certificate in February 2018). Is this something outside of my control, for Comodo to sort out for themselves?

Second: Could that 'DNS CAA No' be the cause of the Android errors? If so, why might it be throwing only Android, when it all seems to work fine on other platforms?

Website Test Results: https://www.ssllabs.com/ssltest/analyze.html?d=method.moda&latest

Improve this question
4
  • I don't know CAA too much. But, I have been seeing CAA zone in Cloudflare. They provide DNS service with CDN. Also, they provide "CAA zone".
    – jefferyear
    Commented Jul 11, 2018 at 16:48
  • Could you confirm the version of android the site is not loading on?
    – jrtapsell
    Commented Jul 11, 2018 at 23:32
  • It looks like the version may be the issue. Android Versions vs CA Cert
    – jrtapsell
    Commented Jul 11, 2018 at 23:36
  • @jrtapsell , it is version 5.0.1; so 2014 / 2015. I'll ask someone with a newer Android version test to confirm your theory. Thanks!
    – Shaun of the Dead
    Commented Jul 13, 2018 at 0:00

1 Answer 1

Reset to default
3

What is CAA?

Imagine a world with 2 CAs G (good) and B(bad).

It would be nice to explicitly say that you only want G to issue certificates for your domain, in a standard way, so that even if someone breaches the outer layers of B, the issuance should be blocked, as the systems that accept the internal request would stop the issuance.

Real world example

For my domain I have the following CAA records:

jrtapsell.co.uk.    300 IN  CAA 0 issuewild "comodoca.com"
jrtapsell.co.uk.    300 IN  CAA 0 issuewild "digicert.com"
jrtapsell.co.uk.    300 IN  CAA 0 issuewild "globalsign.com"
jrtapsell.co.uk.    300 IN  CAA 0 issue "comodoca.com"
jrtapsell.co.uk.    300 IN  CAA 0 issue "digicert.com"
jrtapsell.co.uk.    300 IN  CAA 0 issue "globalsign.com"
jrtapsell.co.uk.    300 IN  CAA 0 issue "letsencrypt.org"
jrtapsell.co.uk.    300 IN  CAA 0 issuewild "letsencrypt.org"

This is the default records for Cloudflare, with LetsEncrypt added on. It means that all of:

  • comodoca.com
    • Comodo
  • digicert.com
    • DigiCert
    • Symantec
    • GeoTrust
    • Thawte
    • RapidSSL
  • globalsign.com
    • GlobalSign
  • letsencrypt.org
    • Let's Encrypt

can issue both single domain and wildcard certificates for my domain. In theory this means that should someone manage to breach the outer layers of a CA's infrastructure, they should be unable to issue certificates for my domain (if the inner layers are breached then there is very little that can be done to prevent issuance, but a system like Certificate Transparency can help in this case)

Could CAA cause this?

No, CAA only affects issuance, not usage of the resulting certificate, so any error in the CAA record should just prevent issuance immediately.

Improve this answer
1
  • 1
    Thanks for the clarification, jrtapsell. I'm still a bit shakey, but that description helped.
    – Shaun of the Dead
    Commented Jul 13, 2018 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.