English

A Call to Reconsider Certification Authority Authorization (CAA)

Cryptography and Security 2026-02-06 v1 Networking and Internet Architecture
Authors: Pouyan Fotouhi Tehrani , Raphael Hiesgen , Thomas C. Schmidt , Matthias Wählisch
View on arXiv ↗ PDF ↗ DOI ↗

Abstract

Certification Authority Authentication (CAA) is a safeguard against illegitimate certificate issuance. We show how shortcomings in CAA concepts and operational aspects undermine its effectiveness in preventing certificate misissuance. Our discussion reveals pitfalls and highlights best practices when designing security protocols based on DNS.

Keywords

authentication protocol digital signature

Cite

@article{arxiv.2411.07702,
  title  = {A Call to Reconsider Certification Authority Authorization (CAA)},
  author = {Pouyan Fotouhi Tehrani and Raphael Hiesgen and Thomas C. Schmidt and Matthias Wählisch},
  journal= {arXiv preprint arXiv:2411.07702},
  year   = {2026}
}

Comments

9 pages, 4 figures

Related papers

View all related →
Cryptography and Security · Computer Science
An Empirical Survey on the Early Adoption of DNS Certification Authority Authorization
Jukka Ruohonen
2019-09-06
Cryptography and Security · Computer Science
Reducing Trust in Automated Certificate Authorities via Proofs-of-Authentication
Zachary Newman
2023-07-18
Networking and Internet Architecture · Computer Science
A Survey of Distributed Certificate Authorities in MANETs
Junaid Chaudhry, Kashif Saleem, Paul Haskell-Dowland, Mahdi H. Miraz
2018-12-14
Cryptography and Security · Computer Science
Do CAA, CT, and DANE Interlink in Certificate Deployments? A Web PKI Measurement Study
Pouyan Fotouhi Tehrani, Raphael Hiesgen, Teresa Lübeck, Thomas C. Schmidt +1
2024-07-03
Cryptography and Security · Computer Science
Certificate Transparency with Privacy
Saba Eskandarian, Eran Messeri, Joseph Bonneau, Dan Boneh
2017-08-08
Cryptography and Security · Computer Science
New Directions for Trust in the Certificate Authority Ecosystem
Jan-Ole Malchow, Benjamin Güldenring, Volker Roth
2018-01-04
Cryptography and Security · Computer Science
Cloud-Based Secure Authentication (CSA) Protocol Suite for Defense against DoS Attacks
Marwan Darwish, Abdelkader Ouda, Luiz Fernando Capretz
2017-11-27
Cryptography and Security · Computer Science
Decentralized Certificate Authorities
Bargav Jayaraman, Hannah Li, David Evans
2017-10-11
Cryptography and Security · Computer Science
SmartCert: Redesigning Digital Certificates with Smart Contracts
Pawel Szalachowski
2020-03-31
Cryptography and Security · Computer Science
Security of Alerting Authorities in the WWW: Measuring Namespaces, DNSSEC, and Web PKI
Pouyan Fotouhi Tehrani, Eric Osterweil, Jochen H. Schiller, Thomas C. Schmidt +1
2021-04-15
Cryptography and Security · Computer Science
Towards a Lightweight Continuous Authentication Protocol for Device-to-Device Communication
Syed W. Shah, Naeem F. Syed, Arash Shaghaghi, Adnan Anwar +2
2020-10-13
Cryptography and Security · Computer Science
On Certificate Management in Named Data Networking
Zhiyi Zhang, Su Yong Wong, Junxiao Shi, Davide Pesavento +2
2020-09-22
Machine Learning · Computer Science
Et Tu Certifications: Robustness Certificates Yield Better Adversarial Examples
Andrew C. Cullen, Shijie Liu, Paul Montague, Sarah M. Erfani +1
2024-06-13
Cryptography and Security · Computer Science
The Boon and Bane of Cross-Signing: Shedding Light on a Common Practice in Public Key Infrastructures
Jens Hiller, Johanna Amann, Oliver Hohlfeld
2020-09-21
Cryptography and Security · Computer Science
Resilient Risk based Adaptive Authentication and Authorization (RAD-AA) Framework
Jaimandeep Singh, Chintan Patel, Naveen Kumar Chaudhary
2022-11-30
Machine Learning · Computer Science
When to Trust AI: Advances and Challenges for Certification of Neural Networks
Marta Kwiatkowska, Xiyue Zhang
2023-09-21
Cryptography and Security · Computer Science
AI and Democracy's Digital Identity Crisis
Shrey Jain, Connor Spelliscy, Samuel Vance-Law, Scott Moore
2023-11-29
Computers and Society · Computer Science
The Contribution of XAI for the Safe Development and Certification of AI: An Expert-Based Analysis
Benjamin Fresz, Vincent Philipp Göbels, Safa Omri, Danilo Brajovic +4
2024-08-06
Machine Learning · Computer Science
Certifiers Make Neural Networks Vulnerable to Availability Attacks
Tobias Lorenz, Marta Kwiatkowska, Mario Fritz
2023-10-04
Cryptography and Security · Computer Science
Support for public-key infrastructures in DNS
Marius Marian, Diana Berbecaru
2019-10-21
Computation and Language · Computer Science
Shh, don't say that! Domain Certification in LLMs
Cornelius Emde, Alasdair Paren, Preetham Arvind, Maxime Kayser +5
2025-03-10
Quantum Physics · Physics
Secure Quantum Passwords
Masahiro Hotta, Masanao Ozawa
2008-06-09
Cryptography and Security · Computer Science
A New Approach: Cognitive Multi-Level Authentication (CMLA) in Nuclear Command and Control
Aysha Shabbir, Maryam Shabbir, Fahad Ahmad, Muhammad Rizwan
2021-03-23
Cryptography and Security · Computer Science
Authority Backdoor: A Certifiable Backdoor Mechanism for Authoring DNNs
Han Yang, Shaofeng Li, Tian Dong, Xiangyu Xu +2
2025-12-12
Cryptography and Security · Computer Science
TrustBase: An Architecture to Repair and Strengthen Certificate-based Authentication
Mark O'Neill, Scott Heidbrink, Jordan Whitehead, Scott Ruoti +3
2016-10-28
R2 v1 2026-06-28T19:56:53.073Z