@jomo @glyph correct me if I’m wrong but CAA tell CAs not to issue a certificate to your domain if you told them not to, they’re not used by UAs to reject certificates issued by the wrong CA, no ? There’s CT but it’s only after the fact, and with CT you don’t need CAA to find a rogue certificate (though it helps automated detection at scale)

If I’m an attacker and I found a CA whose private key is 4, CAA won’t keep me from impersonating the domain, will it ?