Can CA use HTTPS record (RFC 9460) to get IP address of domain?

[Suchan Seo]

Someone asked this at Let's encrypt forum.

https://community.letsencrypt.org/t/support-for-https-records-in-alias-mode/250456

Baseline requirement 3.2.2.4 is silent about how CA parse DNS record to get IP address of a domain, as they are written before this become a thing. I'd say thats a hint, not an authoritative source, but It'd better write explicit rule about this

[Corey Bonnell]

For ACME http-01, using HTTPS records isn't allowed.

TLS BR domain validation method 19 (ACME http-01) requires that validations are done using http-01 as defined in section 8.3 of RFC 8555 [1]. Section 8.3 says:

> As a domain may resolve to multiple IPv4 and IPv6 addresses, the server will connect to at least one of the hosts found in the DNS A and AAAA records, at its discretion.

This makes it clear the IP address must be sourced from an A or AAAA record.

In addition to the above passage, section 8.3 says in the next sentence:

> Because many web servers allocate a default HTTPS virtual host to a particular low-privilege tenant user in a subtle and non-intuitive manner, the challenge must be completed over HTTP, not HTTPS.

Section 9.5 of RFC 9460 [2] states that HTTPS records are a signal to the client to only use secure transport. Using HTTPS records to complete ACME http-01 challenges would violate this, as the initial request must be performed over plaintext HTTP.

Thanks,
Corey

[1] https://datatracker.ietf.org/doc/html/rfc8555#section-8.3
[2] https://datatracker.ietf.org/doc/html/rfc9460#hsts