rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix CAA issuer matching to handle parameters

Browse Source 
CAA issue records may contain parameters after a semicolon per
RFC 8659 (e.g. "letsencrypt.org; accounturi=..."). Split on ";"
and compare only the issuer domain so these records are accepted.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
This commit is contained in:
Bryan Frimin
2026-03-25 12:11:08 +01:00
parent 9b66d05c3c
commit 2004bf6050
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
pkg/certmanager/provisioner.go
View File

@@ -171,10 +171,13 @@ func (p *Provisioner) checkCAARecords(domain string) error {
} }
for _, caa := range caaRecords { for _, caa := range caaRecords {
if caa.Tag == "issue" && strings.EqualFold(caa.Value, p.caaIssuerDomain) { if caa.Tag == "issue" {
issuer, _, _ := strings.Cut(caa.Value, ";")
if strings.EqualFold(strings.TrimSpace(issuer), p.caaIssuerDomain) {
return nil return nil
} }
} }
}
return fmt.Errorf( return fmt.Errorf(
"caa records for domain %q do not permit issuance by %q", "caa records for domain %q do not permit issuance by %q",