标题： CAA、CT和DANE在证书部署中是否相互关联？ 一个Web PKI测量研究 显示英文标题

标题： Do CAA, CT, and DANE Interlink in Certificate Deployments? A Web PKI Measurement Study

摘要： 网站的信任和完整性依赖于 X.509 证书。这些证书的误用或错误发放威胁着 Web PKI 安全模型，从而促使了几种保护技术的发展。本文从正在使用的证书的角度研究了 DNS/DNSSEC 记录中的 CAA 和 TLSA 以及 CT 日志。我们的测量涵盖了 400 万个流行的域名，我们探索了不同扩展的存在性和一致性。我们的发现表明，CAA 几乎只在没有 DNSSEC 的情况下部署，而受 DNSSEC 保护的服务名称倾向于不使用 DNS 来保护证书。尽管大多数情况下正确部署，CAA 的 CA 字符串往往不能选择性地分离 CA，并且许多域持有超出 CAA 语义的证书。TLSA 记录经常维护不当，有时会在没有 DNSSEC 的情况下出现。 显示英文摘要

摘要： Integrity and trust on the web build on X.509 certificates. Misuse or misissuance of these certificates threaten the Web PKI security model, which led to the development of several guarding techniques. In this paper, we study the DNS/DNSSEC records CAA and TLSA as well as CT logs from the perspective of the certificates in use. Our measurements comprise 4 million popular domains, for which we explore the existence and consistency of the different extensions. Our findings indicate that CAA is almost exclusively deployed in the absence of DNSSEC, while DNSSEC protected service names tend to not use the DNS for guarding certificates. Even though mainly deployed in a formally correct way, CAA CA-strings tend to not selectively separate CAs, and numerous domains hold certificates beyond the CAA semantic. TLSA records are repeatedly poorly maintained and occasionally occur without DNSSEC.