V1.00.128.2025.06.03
Signed-off-by: Marc S. Weidner <msw@coresecret.dev>
This commit is contained in:
@@ -1,5 +1,96 @@
|
||||
# draft-weidner-catalog-rr-ext
|
||||
---
|
||||
gitea: none
|
||||
include_toc: true
|
||||
---
|
||||
|
||||
This RFC I-D proposes an extension to the Certification Authority Authorization (CAA) DNS
|
||||
Resource Record (RR) that enables the mandatory or optional binding of Certificate Transparency
|
||||
(CT) Log URIs directly within DNS.
|
||||
[](https://git.coresecret.dev/msw/draft-weidner-catalog-rr-ext.git)
|
||||
|
||||
[](https://eupl.eu/1.2/en/)
|
||||
[](https://opensource.org/license/eupl-1-2)
|
||||
[](https://docs.gitea.com/)
|
||||
[](https://www.jetbrains.com/store/?section=personal&billing=yearly)
|
||||
[](https://keepassxc.org/)
|
||||
[](https://www.netcup.com/de)
|
||||
[](https://coresecret.eu/)
|
||||
[](https://x.com/coresecret_eu)
|
||||
[](https://coresecret.eu/spenden/#sepa)
|
||||
[](https://coresecret.eu/spenden/#bitcoin)
|
||||
[](https://coresecret.eu/contact/#simplex)
|
||||
|
||||
# 1. RFC I-D draft-weidner-catalog-rr-ext
|
||||
|
||||
**Centurion Intelligence Consulting Agency Information Security Standard**<br>
|
||||
*RFC I-D draft-weidner-catalog-rr-ext*<br>
|
||||
**Master Version**: 1.00<br>
|
||||
**Build**: V1.00.128.2025.06.03<br>
|
||||
|
||||
The RFC I-D **draft-weidner-catalog-rr-ext** proposes an extension to the Certification Authority Authorization
|
||||
(CAA) DNS Resource Record (RR) that enables the mandatory or optional binding of Certificate Transparency (CT)
|
||||
Log URIs directly within DNS. By embedding CT-Log endpoints in CAA RR, Certification Authorities (CAs) gain a
|
||||
standardized, discoverable mechanism for retrieving preferred and permitted CT-Log endpoint information, thereby
|
||||
enhancing the security and auditability of X.509 TLS certificate issuance.
|
||||
|
||||
* The most recent working version of this document, open issues, and related resources are available here.
|
||||
* The author gratefully accepts pull requests.
|
||||
* The author's PGP keys are available at: ``/.pubkey``
|
||||
|
||||
Check out more:
|
||||
* [CenturionNet Services](https://coresecret.eu/cnet/)
|
||||
* [CenturionDNS Resolver](https://dns.eddns.eu/)
|
||||
* [CenturionDNS Blocklist](https://dns.eddns.eu/blocklists/centurion_titanium_ultimate.txt)
|
||||
* [CenturionNet Status](https://uptime.coresecret.eu/)
|
||||
* [CenturionMeet](https://talk.e2ee.li/)
|
||||
* [Contact the author](https://coresecret.eu/contact/)
|
||||
|
||||
|
||||
## 1.1. Preliminary Remarks
|
||||
|
||||
### 1.1.1. HSM
|
||||
Please note that all my signing keys are stored in an HSM and that the signing environment is air-gapped. The next step is to
|
||||
move to a room-gapped environment. ^^
|
||||
|
||||
### 1.1.2. DNSSEC, HSTS, TLS
|
||||
|
||||
Please note that `coresecret.dev` is included in the [(HSTS Preload List)](https://hstspreload.org/) and always serves the headers:
|
||||
````nginx configuration pro
|
||||
add_header Expect-CT "max-age=86400, enforce" always;
|
||||
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
|
||||
````
|
||||
|
||||
* Additionally, the entire zone is dual-signed with **DNSSEC**. See the current **DNSSEC** status at: **[DNSSEC Audit Report](/docs/AUDIT_DNSSEC.md)**
|
||||
* A comprehensive TLS audit of the **`git.coresecret.dev`** Gitea server is also available. See: **[TLS Audit Report](/docs/AUDIT_TLS.md)**
|
||||
* The infrastructure of the **`CISS.debian.live.builder`** building system is visualized here. See: **[Centurion Net](/docs/CNET.md)**
|
||||
|
||||
### 1.1.3. Gitea Action Runner Hardening
|
||||
|
||||
The CI runners operate on a dedicated host system located in a completely separate Autonomous System (AS). This host is solely
|
||||
dedicated to providing CI runners and does not perform any other tasks. Each runner is hermetically isolated from others using
|
||||
non-privileged, shell-less user accounts with no direct login capability. Additionally, each runner executes within its own
|
||||
separate directory tree, employs `DynamicUser` features, and adheres to strict systemd hardening policies (achieving a ``systemd-analyze security``
|
||||
rating of **``2.6``**). Docker containers used by runners do not run in privileged mode. Security is further enhanced through the use
|
||||
of both UFW software firewalls and dedicated hardware firewall appliances.
|
||||
|
||||
## 1.2. Versioning Schema
|
||||
|
||||
This project adheres strictly to a structured versioning scheme following the pattern x.y.z-Date.
|
||||
|
||||
Example: `1.00.128.2025.06.03`
|
||||
|
||||
`x.y.z` represents major (x), minor (y), and patch (z) version increments.
|
||||
|
||||
Date (YYYY.MM.DD) denotes the build or release date, facilitating clear tracking of incremental changes and ensuring
|
||||
reproducibility and traceability.
|
||||
|
||||
# 3. Licensing & Compliance
|
||||
|
||||
This repository is fully SPDX-compliant. All source files include appropriate SPDX license identifiers and headers to ensure
|
||||
clear and unambiguous licensing. You can verify compliance by reviewing the top of each file, which follows the SPDX
|
||||
standard for license expressions and metadata.
|
||||
|
||||
# 4. Disclaimer
|
||||
|
||||
This README is provided "as-is" without any warranty.
|
||||
|
||||
---
|
||||
**[no tracking | no logging | no advertising | no profiling | no bullshit](https://coresecret.eu/)**
|
||||
<!-- vim: set number et ts=2 sw=2 sts=2 ai tw=128 ft=markdown -->
|
||||
|
||||
Reference in New Issue
Block a user