fedora-infrastructure

#5688 Add CAA DNS RR to getfedora.org and fedoraproject.org zone files
Closed: Fixed Opened by robert.

Closed: Fixed
Reopen Issue

DNS Certification Authority Authorization (CAA) is specified by RFC 6844, see e.g. https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization for more details. As of writing, there is no CAA DNS RR e.g. for the zones getfedora.org and fedoraproject.org.

At https://sslmate.com/labs/caa/ there is a webbased generator (including RFC 3597 syntax for old BIND installations).

getfedora.org.  CAA 0 issue "digicert.com"
getfedora.org.  CAA 0 issuewild ";"
getfedora.org.  CAA 0 iodef "mailto:hostmaster@fedoraproject.org"
fedoraproject.org.  CAA 0 issue ";"
fedoraproject.org.  CAA 0 issuewild "digicert.com"
fedoraproject.org.  CAA 0 iodef "mailto:hostmaster@fedoraproject.org"

Having the records also for other zones managed via the Fedora infrastructure team might make sense.

Maybe add this:

fedoraproject.org.  CAA 0 issue "digicert.com"
fedoraproject.org.  CAA 0 issue "letsencrypt.org"
fedoraproject.org.  CAA 0 issuewild "digicert.com"

We get wildcards from Digicert, and some normal certs from Digicert, and we also get some certs from Letsencrypt.
The iodef one we can add later when this is added to the certificate management system.

That could be fine – I've no exact idea where the certificates come from, I just tried to figure it out by looking up some (sub-)domains.

Done. I have added the CAA records to fedoraproject.org and getfedora.org.

:running_shirt_with_sash:

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.