Hello everyone, I would like to ask about experiences with implementation of CAA (Certification Authority Authorization) on DNS (GTM) on F5 v12 and higher? I have been trying to find some tech_doc about it, but nothing about this topic relation to f5.
I appreciate each useful experiences or sources.
Thank you AK
Not an answer (sorry) but looking in to CAA myself and failing to find any information on it, however we are still running 11.6 on our devices.
Does 12 support the CAA record or allow the previous BIND type 257 records?
I was wondering if nothing else trying to manually edit the zone file and hope zonerunner doesnt go in to a restart loop
The CABForum announced CAA woudl be required required in March
The requirement is now in place effective September 8, 2017.
SSLMate has a tool for generating CAA records:
There should be some public guidance by now?
In case this wasn't already answered, BIG-IP 12.x, 13.x, and 14.x have a high enough version of BIND that you can manually edit the zone files (carefully) to add the CAA record. See https://support.f5.com/csp/article/K7032.
I understand that using Zone Runner to manage CAA record types are on the roadmap for 14.x.
We implemented a CAA record on our F5 DNS the manual way and it worked for us.
I think this feature came along in BIG-IP 14.X. I know the ability to work with CAA in Zone Runner is there in 15.x
Probably came along with BIND 9.9.6+ support somewhere in there. I can't find the exact release notes at the moment.