StartCom: CAA mis-issuance on CNAME pointing directly to restrictive CAA record

The case reports that StartCom issued a certificate for a domain whose CNAME pointed directly to another domain with a restrictive CAA record. The reporter described a test setup where www.gazebear.online was a CNAME to gazebear.net, and gazebear.net contained a CAA record with "issue ;"; despite this, StartCom issued a certificate for www.gazebear.online. The reporter said they communicated the issue to StartCom on Oct 16, 2017 and continued discussing it, but a root cause had not yet been identified in the initial report. StartCom responded that they installed EJBCA 6.10.0 and believed the error was fixed, and they planned further updates after Primekey released a patch (6.10.0.1) addressing CAA test suites. Mozilla later noted that StartCom was exiting the CA business. The bug was resolved as WONTFIX.

1. 2017-10-16 StartCom issued a certificate for a CNAME target despite a restrictive CAA record on the CNAME target domain.
2. 2017-11-09 StartCom reported installing EJBCA 6.10.0 and planned updates after a CAA-related patch (6.10.0.1).
3. 2017-11-28 Mozilla noted StartCom was exiting the CA business.

1. 2017-10-18 Community commenter — Reported that StartCom issued a certificate for www.gazebear.online even though the CNAME target domain had a restrictive CAA record ("issue ;"), and provided certificate and DNS references.
2. 2017-11-09 WoSign CA Limited — Said StartCom installed EJBCA 6.10.0 and believed the issue was fixed, and that they would update further after Primekey released EJBCA 6.10.0.1 with corrected CAA test handling.
3. 2017-11-28 Mozilla representative — Noted that StartCom is exiting the CA business.