CAA blocks wildcard certificate issuance specifically

dig +short CAA example.com

dig +short CAA example.com | grep issuewild

dig +trace CAA example.com

certbot certonly --manual -d '*.example.com' -d example.com --dry-run
# bad result: caa: CAA record for example.com prevents issuance
#             (reported for the *.example.com identifier only)

; bad: issuewild names a different CA than issue, or denies everything
example.com.  3600  IN  CAA  0  issue "letsencrypt.org"
example.com.  3600  IN  CAA  0  issuewild "sectigo.com"
; or:
example.com.  3600  IN  CAA  0  issuewild ";"

; good: issuewild matches issue, so the same CA works for both
example.com.  3600  IN  CAA  0  issue "letsencrypt.org"
example.com.  3600  IN  CAA  0  issuewild "letsencrypt.org"

; also good: no issuewild at all, issue governs both non-wildcard and wildcard
example.com.  3600  IN  CAA  0  issue "letsencrypt.org"

curl -X DELETE "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{record_id}" \
  -H "Authorization: Bearer {CLOUDFLARE_API_TOKEN}"

curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records" \
  -H "Authorization: Bearer {CLOUDFLARE_API_TOKEN}" \
  -H "Content-Type: application/json" \
  --data '{"type":"CAA","name":"example.com","data":{"flags":0,"tag":"issuewild","value":"letsencrypt.org"}}'

dig +short CAA example.com
# good result: issuewild names the intended CA, or is absent entirely

certbot certonly --manual -d '*.example.com' --dry-run
# good result: completes with no caa error

echo | openssl s_client -connect example.com:443 -servername sub.example.com 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName
# good result: subjectAltName includes DNS:*.example.com

"""Detect an issuewild CAA record that blocks wildcard certificate issuance
and, on repair, correct it through the Cloudflare API. Safe to run on a
schedule. Stays in dry run until DRY_RUN=false.
"""
import os
import logging

logging.basicConfig(level=logging.INFO, format="%(asctime)s %(levelname)s %(message)s")
log = logging.getLogger("wildcard_caa_check")


def wildcard_caa_blocked(caa_records, desired_ca):
    """Pure decision function. No network, no I/O.

    caa_records is a list of (flags, tag, value) tuples parsed from the
    apex CAA RRset. desired_ca is the CA identification domain the ACME
    client will use, such as "letsencrypt.org".

    Returns (True, reason) if any issuewild record exists whose value is
    not desired_ca or equals ";" (explicit deny), while at least one
    issue record equals desired_ca. That combination means non-wildcard
    issuance would succeed but wildcard issuance would fail.

    Returns (False, "") otherwise: no issuewild present, or issuewild
    already matches desired_ca.
    """
    issue_values = [value for (_, tag, value) in caa_records if tag == "issue"]
    issuewild_values = [value for (_, tag, value) in caa_records if tag == "issuewild"]

    if not issuewild_values:
        return (False, "")

    if desired_ca not in issue_values:
        return (False, "")

    for value in issuewild_values:
        if value == ";":
            return (True, f"issuewild is set to deny all wildcard issuers (\";\"), but issue allows {desired_ca}")
        if value != desired_ca:
            return (True, f"issuewild names {value}, which does not match the issue value {desired_ca}")

    return (False, "")


def run():
    # Imported lazily so the pure function above can be tested with no
    # network libraries installed at all.
    import dns.resolver
    import requests

    zone_apex = os.environ["DNS_DOMAIN"]
    desired_ca = os.environ.get("DESIRED_CA", "letsencrypt.org")
    dry_run = os.environ.get("DRY_RUN", "true").lower() == "true"

    answer = dns.resolver.resolve(zone_apex, "CAA")
    caa_records = []
    for rdata in answer:
        tag = rdata.tag.decode() if isinstance(rdata.tag, bytes) else rdata.tag
        value = rdata.value.decode() if isinstance(rdata.value, bytes) else rdata.value
        caa_records.append((rdata.flags, tag, value))

    blocked, reason = wildcard_caa_blocked(caa_records, desired_ca)
    if not blocked:
        log.info("No wildcard-blocking issuewild mismatch found for %s", zone_apex)
        return

    log.warning("Wildcard issuance blocked for %s: %s", zone_apex, reason)

    zone_id = os.environ["CLOUDFLARE_ZONE_ID"]
    api_token = os.environ["CLOUDFLARE_API_TOKEN"]
    headers = {"Authorization": f"Bearer {api_token}", "Content-Type": "application/json"}

    resp = requests.get(
        f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records",
        headers=headers,
        params={"type": "CAA"},
        timeout=30,
    )
    resp.raise_for_status()
    records = resp.json()["result"]

    offending = next((r for r in records if r.get("data", {}).get("tag") == "issuewild"), None)

    if dry_run:
        if offending:
            log.info("Dry run: would update record %s issuewild to %s", offending["id"], desired_ca)
        else:
            log.info("Dry run: would create a new issuewild record set to %s", desired_ca)
        return

    payload = {
        "type": "CAA",
        "name": zone_apex,
        "data": {"flags": 0, "tag": "issuewild", "value": desired_ca},
    }

    if offending:
        put_resp = requests.put(
            f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records/{offending['id']}",
            headers=headers,
            json=payload,
            timeout=30,
        )
        put_resp.raise_for_status()
        log.info("Updated issuewild record for %s to %s", zone_apex, desired_ca)
    else:
        post_resp = requests.post(
            f"https://api.cloudflare.com/client/v4/zones/{zone_id}/dns_records",
            headers=headers,
            json=payload,
            timeout=30,
        )
        post_resp.raise_for_status()
        log.info("Created issuewild record for %s set to %s", zone_apex, desired_ca)


if __name__ == "__main__":
    run()

/**
 * Detect an issuewild CAA record that blocks wildcard certificate issuance
 * and, on repair, correct it through the Cloudflare API. Safe to run on a
 * schedule. Stays in dry run until DRY_RUN=false.
 */
import { pathToFileURL } from "node:url";

export function wildcardCaaBlocked(caaRecords, desiredCa) {
  // Pure decision function. No network, no I/O.
  //
  // caaRecords is an array of [flags, tag, value] tuples parsed from the
  // apex CAA RRset. desiredCa is the CA identification domain the ACME
  // client will use, such as "letsencrypt.org".
  //
  // Returns [true, reason] if any issuewild record exists whose value is
  // not desiredCa or equals ";" (explicit deny), while at least one issue
  // record equals desiredCa. That combination means non-wildcard issuance
  // would succeed but wildcard issuance would fail.
  //
  // Returns [false, ""] otherwise: no issuewild present, or issuewild
  // already matches desiredCa.
  const issueValues = caaRecords.filter(([, tag]) => tag === "issue").map(([, , value]) => value);
  const issuewildValues = caaRecords.filter(([, tag]) => tag === "issuewild").map(([, , value]) => value);

  if (issuewildValues.length === 0) {
    return [false, ""];
  }

  if (!issueValues.includes(desiredCa)) {
    return [false, ""];
  }

  for (const value of issuewildValues) {
    if (value === ";") {
      return [true, `issuewild is set to deny all wildcard issuers (";"), but issue allows ${desiredCa}`];
    }
    if (value !== desiredCa) {
      return [true, `issuewild names ${value}, which does not match the issue value ${desiredCa}`];
    }
  }

  return [false, ""];
}

export async function run() {
  // Imported lazily so the pure function above can be tested with no
  // network modules touched at all.
  const dns = await import("node:dns");
  const resolvePromises = dns.promises;

  const zoneApex = process.env.DNS_DOMAIN;
  const desiredCa = process.env.DESIRED_CA || "letsencrypt.org";
  const dryRun = (process.env.DRY_RUN || "true").toLowerCase() === "true";

  const answers = await resolvePromises.resolveCaa(zoneApex);
  // node:dns resolveCaa returns { critical, issue } or { critical, issuewild } shaped
  // entries, so normalize into (flags, tag, value) tuples first.
  const normalized = answers.map((a) => {
    const tag = a.issue !== undefined ? "issue" : a.issuewild !== undefined ? "issuewild" : "unknown";
    const value = a.issue !== undefined ? a.issue : a.issuewild;
    return [a.critical ? 128 : 0, tag, value];
  });

  const [blocked, reason] = wildcardCaaBlocked(normalized, desiredCa);
  if (!blocked) {
    console.log(`No wildcard-blocking issuewild mismatch found for ${zoneApex}`);
    return;
  }

  console.warn(`Wildcard issuance blocked for ${zoneApex}: ${reason}`);

  const zoneId = process.env.CLOUDFLARE_ZONE_ID;
  const apiToken = process.env.CLOUDFLARE_API_TOKEN;
  const headers = { Authorization: `Bearer ${apiToken}`, "Content-Type": "application/json" };

  const listRes = await fetch(
    `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records?type=CAA`,
    { headers },
  );
  if (!listRes.ok) throw new Error(`Cloudflare API returned ${listRes.status}`);
  const { result: records } = await listRes.json();

  const offending = records.find((r) => r.data && r.data.tag === "issuewild");

  const payload = {
    type: "CAA",
    name: zoneApex,
    data: { flags: 0, tag: "issuewild", value: desiredCa },
  };

  if (dryRun) {
    if (offending) {
      console.log(`Dry run: would update record ${offending.id} issuewild to ${desiredCa}`);
    } else {
      console.log(`Dry run: would create a new issuewild record set to ${desiredCa}`);
    }
    return;
  }

  if (offending) {
    const putRes = await fetch(
      `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records/${offending.id}`,
      { method: "PUT", headers, body: JSON.stringify(payload) },
    );
    if (!putRes.ok) throw new Error(`Cloudflare API returned ${putRes.status}`);
    console.log(`Updated issuewild record for ${zoneApex} to ${desiredCa}`);
  } else {
    const postRes = await fetch(
      `https://api.cloudflare.com/client/v4/zones/${zoneId}/dns_records`,
      { method: "POST", headers, body: JSON.stringify(payload) },
    );
    if (!postRes.ok) throw new Error(`Cloudflare API returned ${postRes.status}`);
    console.log(`Created issuewild record for ${zoneApex} set to ${desiredCa}`);
  }
}

if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
  run().catch((err) => { console.error(err); process.exit(1); });
}

from wildcard_caa_check import wildcard_caa_blocked


def test_blocked_when_issuewild_names_different_ca():
    records = [(0, "issue", "letsencrypt.org"), (0, "issuewild", "sectigo.com")]
    blocked, reason = wildcard_caa_blocked(records, "letsencrypt.org")
    assert blocked is True
    assert "sectigo.com" in reason


def test_blocked_when_issuewild_denies_all():
    records = [(0, "issue", "letsencrypt.org"), (0, "issuewild", ";")]
    blocked, reason = wildcard_caa_blocked(records, "letsencrypt.org")
    assert blocked is True
    assert "deny all" in reason


def test_not_blocked_when_issuewild_matches():
    records = [(0, "issue", "letsencrypt.org"), (0, "issuewild", "letsencrypt.org")]
    blocked, reason = wildcard_caa_blocked(records, "letsencrypt.org")
    assert blocked is False
    assert reason == ""


def test_not_blocked_when_no_issuewild_present():
    records = [(0, "issue", "letsencrypt.org")]
    blocked, reason = wildcard_caa_blocked(records, "letsencrypt.org")
    assert blocked is False
    assert reason == ""

import { test } from "node:test";
import assert from "node:assert/strict";
import { wildcardCaaBlocked } from "./wildcard-caa-check.js";

test("blocked when issuewild names different ca", () => {
  const records = [[0, "issue", "letsencrypt.org"], [0, "issuewild", "sectigo.com"]];
  const [blocked, reason] = wildcardCaaBlocked(records, "letsencrypt.org");
  assert.equal(blocked, true);
  assert.match(reason, /sectigo\.com/);
});

test("blocked when issuewild denies all", () => {
  const records = [[0, "issue", "letsencrypt.org"], [0, "issuewild", ";"]];
  const [blocked, reason] = wildcardCaaBlocked(records, "letsencrypt.org");
  assert.equal(blocked, true);
  assert.match(reason, /deny all/);
});

test("not blocked when issuewild matches", () => {
  const records = [[0, "issue", "letsencrypt.org"], [0, "issuewild", "letsencrypt.org"]];
  const [blocked, reason] = wildcardCaaBlocked(records, "letsencrypt.org");
  assert.equal(blocked, false);
  assert.equal(reason, "");
});

test("not blocked when no issuewild present", () => {
  const records = [[0, "issue", "letsencrypt.org"]];
  const [blocked, reason] = wildcardCaaBlocked(records, "letsencrypt.org");
  assert.equal(blocked, false);
  assert.equal(reason, "");
});