How can I look up a Certificate Authorities CAA record value?

Question

I'd like to publish a CAA record for a domain and while I am familiar with the format I do not know what to use for the value. For example, Comodo certs would use 0 issue "comodoca.com" and Certbot would use 0 issue "letsencrypt.org". I need a way to look up what to use for the quoted value when it is not known.

I know that online CAA record generators exist but the CA I use is not listed. Is there a way to look this up online, or extract the value from one of the certificates in the trust chain?

In this instance, I'm trying to learn what to use for Amazon CloudFront (now that Route 53 supports CAA) but I would like to know how to find this value for any issuer. A CLI solution using openssl would be great but an online list is fine also.

EDIT: Checking CAA records becomes mandatory for CA's two weeks from today, and comparing this incomplete list suggested in responses against Mozilla's list of CA's shows a huge discrepancy. For domain owners who wish to publish CAA records today and selectively whitelist trusted CA's, is there no reference material online?

Answer 1

The best way I can think of is asking the CAA record of issuers' domain. Most likely they have it setup for their own domains. I tried it with a few and it seems to work for some.

$ dig caa comodo.com
...
comodo.com.     1013    IN  CAA 0 issue "comodoca.com"
...
$ dig caa symantec.com
...
symantec.com.       3599    IN  CAA 0 issue "symantec.com"
...
$ dig caa digicert.com
...
digicert.com.       3599    IN  CAA 0 issue "digicert.com"
...

vcjones also pointed out there is a list maintained by Mozilla here.

Apart from these, your best bet is probably asking the CA what value they need in this field.

Answer 2

The official, up-to-date CCADB table of CAA identifiers is here:

https://ccadb-public.secure.force.com/mozilla/CAAIdentifiersReport

(The Resources page links to it.)

I don't know precisely what the status of that information is, but it should be reliable. The Mozilla Root Store Policy incorporates the Common CCADB Policy, which has a general requirement that CAs accurately maintain information, and CAA identifiers rarely change.

The most authoritative source for a CA's CAA identifiers is its CP or CPS: The Baseline Requirements, which CAs in the web PKI must follow, currently state:

Section 4.2 of a CA’s Certificate Policy and/or Certification Practice Statement SHALL state the CA’s policy or practice on processing CAA Records for Fully‐Qualified Domain Names; that policy shall be consistent with these Requirements. It shall clearly specify the set of Issuer Domain Names that the CA recognizes in CAA “issue” or “issuewild” records as permitting it to issue.

(Section 2.2 of version 1.8.4.)

For example, if you check Amazon Trust Services's documents, the list is currently in section 4.2.1 of CPS version 1.0.13.

Beyond that, Amazon's documentation currently has a Configure a CAA Record page that also includes the list.