*.lisp: Add CAA records to discourage wrong CAs from issuing.

CAs are generally uselsss and can't be relied on to take any notice, but
it's better than nothing.

Add a record for our own CA for form's sake, even though I don't take
any notice.

diff --git a/binswood.lisp b/binswood.lisp
index 957273c..322929d 100644 (file)
--- a/binswood.lisp
+++ b/binswood.lisp
@@ -21,6 +21,10 @@
        (mythic-beasts-2.ns :ip mythic-ns2)
        (mythic-beasts-3.ns :ip mythic-ns3))
 
+  ;; Certification.
+  :caa ((:issue "letsencrypt.org")
+       (:issue "distorted.org.uk"))
+
   ;; Internal hosts.
   (binswrt :a binswrt.binswood)
   (mango :a mango.binswood)

diff --git a/distorted.lisp b/distorted.lisp
index d71124a..e17768b 100644 (file)
--- a/distorted.lisp
+++ b/distorted.lisp
@@ -77,6 +77,10 @@
        #-view/inside (mythic-beasts-3.ns :ip mythic-ns3)
        #-view/inside (chiark.ns :ip chiark.greenend.org.uk))
 
+  ;; Certification.
+  :caa ((:issue "letsencrypt.org")
+       (:issue "distorted.org.uk"))
+
   ;; Mail servers.
   ((@ mail blackhole) :mx mail :srv ((:smtp mail)))
   ((bugs) :ttl 300 :mx lists :srv ((:smtp bugs)))

diff --git a/escorted.lisp b/escorted.lisp
index ab5c5b3..e2f542d 100644 (file)
--- a/escorted.lisp
+++ b/escorted.lisp
@@ -20,6 +20,10 @@
   ;; Web service.
   ((@ www) :svc stratocaster)
 
+  ;; Certification.
+  :caa ((:issue "letsencrypt.org")
+       (:issue "distorted.org.uk"))
+
   ;; Mail servers
   :mx ((mail :ip stratocaster))
   :srv ((:smtp mail))

diff --git a/odin.lisp b/odin.lisp
index 3ef3a87..f17fc24 100644 (file)
--- a/odin.lisp
+++ b/odin.lisp
@@ -19,6 +19,10 @@
           :tlsa (:https (:service-certificate-constraint
                          :public-key :sha-256 #p"https-stratocaster")))
 
+  ;; Certification.
+  :caa ((:issue "letsencrypt.org")
+       (:issue "distorted.org.uk"))
+
   ;; Mail servers
   :mx ((mail :ip stratocaster))
   :srv ((:smtp mail))