授權憑證機構簽發憑證（CAA）紀錄之處理

CAA record processing

As part of the Certificate issuance process, the CA MUST retrieve and process CAA records in accordance with RFC 8659 for each dNSName in the subjectAltName extension that does not contain an Onion Domain Name. These practices MUST be described in Section 4.2 of the CA’s Certificate Policy and/or Certification Practice Statement, including specifying the set of Issuer Domain Names that the CA recognizes in CAA “issue” or “issuewild” records as permitting it to issue.

作為憑證簽發流程的一部分，憑證機構（Certification Authority，CA）應（MUST）針對 subjectAltName 擴充欄位中不包含 Onion 網域名稱（Onion Domain Name）之每個 dNSName，依據 RFC 8659 取得並處理 CAA 紀錄。這些實務作業應（MUST）於 CA 的憑證政策（Certificate Policy，CP）及／或憑證實務作業基準（Certification Practice Statement，CPS）第 4.2 節中說明，其中應具體包含該 CA 於 CAA 「issue」或「issuewild」紀錄中所認可、並允許其簽發憑證之簽發者網域名稱（Issuer Domain Names）集合。

CAs MAY check CAA records at any other time.

CA 得（MAY）在任何其他時間檢查 CAA 紀錄。

When processing CAA records, CAs MUST process the issue, issuewild, and iodef property tags as specified in RFC 8659, although they are not required to act on the contents of the iodef property tag. Additional property tags MAY be supported, but MUST NOT conflict with or supersede the mandatory property tags set out in this document. CAs MUST respect the critical flag and not issue a certificate if they encounter an unrecognized property tag with this flag set.

當處理 CAA 紀錄時，CA 應（MUST）依據 RFC 8659 之規定解析並處理 issue、issuewild 與 iodef 屬性標籤，但不要求對 iodef 屬性標籤的內容採取任何動作。CA 得（MAY）支援額外的屬性標籤，但不得（MUST NOT）與本文件所規定的強制性屬性標籤發生衝突，或凌駕於其上。CA 應（MUST）遵守關鍵性旗標（critical flag）之要求，若遇到設有該旗標之無法識別的屬性標籤，不得簽發憑證。

If the CA issues a certificate after processing a CAA record, it MUST do so within the TTL of the CAA record, or 8 hours, whichever is greater.

若 CA 處理 CAA 紀錄完成後要簽發憑證，應（MUST）在 CAA 紀錄的 TTL（Time to Live）設定值或 8 小時內（以時間較長者為準）簽發憑證。

RFC 8659 requires that CAs “MUST NOT issue a certificate unless the CA determines that either (1) the certificate request is consistent with the applicable CAA RRset or (2) an exception specified in the relevant CP or CPS applies.” For issuances conforming to these Baseline Requirements, CAs MUST NOT rely on any exceptions specified in their CP or CPS unless they are one of the following:

RFC 8659 要求 CA「除非 CA 判定下列任一情況成立，否則不得（MUST NOT）簽發憑證（1）憑證申請符合適用的 CAA 資源記錄集（CAA Resource Record Set，CAA RRset）；或（2）適用相關憑證政策（CP）或憑證實務作業基準（CPS）所規定之例外情況。」。對於依據本《基本要求》規定所簽發之憑證，CA 不得（MUST NOT）援用其 CP 或 CPS 所規定之任何例外情況，除非該例外情況為以下情形之一：

• CAA checking is optional for certificates for which a Certificate Transparency Precertificate (see Section 7.1.2.9) was created and logged in at least two public logs, and for which CAA was checked at time of Precertificate issuance.

• 已產生憑證透明度預簽憑證（Certificate Transparency Precertificate，參見第 7.1.2.9 節）、且該預簽憑證登錄於至少兩個公開記錄系統，以及在簽發預簽憑證時已完成 CAA 檢查之憑證，無須再次執行 CAA 檢查。

• CAA checking is optional for certificates issued by a Technically Constrained Subordinate CA Certificate as set out in Section 7.1.2.3 or Section 7.1.2.5, where the lack of CAA checking is an explicit contractual provision in the contract with the Applicant.

• 依第 7.1.2.3 節或第 7.1.2.5 節規定的受技術約束之下屬憑證機構憑證（Technically Constrained Subordinate CA Certificate）所簽發之憑證，若與申請者的契約中已明文約定不執行 CAA 檢查，則無須再次執行 CAA 檢查。

CAs are permitted to treat a record lookup failure as permission to issue if:

於下列情況，允許 CA 將 CAA 檢查失敗視為許可簽發：

• the failure is outside the CA’s infrastructure; and

• 查詢失敗發生於 CA 的基礎設施之外；且

• the lookup has been retried at least once; and

• 查詢已重試至少 1 次；且

• the CA has confirmed that the domain is “Insecure” as defined in RFC 4035 Section 4.3.

• CA 已確認該網域符合 RFC 4035 第 4.3 節 定義的「Insecure」（未受 DNSSEC 保護）。

CAs MUST document potential issuances that were prevented by a CAA record in sufficient detail to provide feedback to the CA/Browser Forum on the circumstances, and SHOULD dispatch reports of such issuance requests to the contact(s) stipulated in the CAA iodef record(s), if present. CAs are not expected to support URL schemes in the iodef record other than mailto: or https:.

CA 應（MUST）以書面文件記錄因 CAA 紀錄而中止的憑證簽發，以便向 CA/Browser Forum 提供相關情況的回饋，若 CAA iodef 紀錄存在，宜（SHOULD）將此類簽發申請的相關報告傳送至該紀錄中所指定之聯絡人。CA 無須支援 iodef 紀錄中 mailto: 或 https: 以外的 URL 協定。

DNSSEC validation MUST be performed in accordance with Section 4.2.2.2 on all DNS queries associated with CAA record lookups performed by the Primary Network Perspective.

由主要網路視角（Primary Network Perspective）執行之 CAA 紀錄檢查相關的所有 DNS 查詢，應（MUST）依據第 4.2.2.2 節執行 DNSSEC 驗證。