This commit implements RFC 6844's description of the "CAA issuewild property" for CAA records. We check CAA in two places: at the time of validation, and at the time of issuance when an authorization is more than 8hours old. Both locations have been updated to properly enforce issuewild when checking CAA for a domain corresponding to a wildcard name in a certificate order. Resolves https://github.com/letsencrypt/boulder/issues/3211 |
||
|---|---|---|
| .. | ||
| generate.go | ||
| va.pb.go | ||
| va.proto | ||