Where should CAA issuer IDs be obtained from and how should they be validated?

Solution 1:

The relevant RFC 6844 doesn't mandate any standard for the issuer, actually the opposite, it grants almost complete freedom:

The semantics of issuer-parameters are determined by the issuer alone.

But to take a step back: CAA records were not intended, as far as I know, to be used by end-users to validate if the TLS certificate they get presented with is issued by the correct certificate issuer.

It was intended to only be used by a (reputable) certificate issuer to validate that they are allowed to issue a (new) certificate for that host/domain.

It is only the certificate issuer that needs to check if whatever they expect/require is present in the CAA record, if a CAA record exists.

Your certificate issuer, i.e. your CA, will need to communicate which domain(s) they recognise in the CAA issue records. And also which, if any, other parameters they require.

For example: Comodo, which uses comodo.com for its online brand, is completely free to recognise the completely different domain comodoca.com in CAA records. Actually CAs are also not restricted to only recognise a single domain - Comodo for instance recognises four different ones: comodo.com, comodoca.com, usertrust.com and trust-provider.com

Note: CAA records are only used when issuing a certificate. Reverse engineering what the CAA record should be from valid certificates that have already been issued serves no immediate purpose.

Where should CAA issuer IDs be obtained from?

As far as I know there is nothing that you can easily automate with regards to that, but for a manual approach: The CA/Browser forum requires a uniform location for that info to be published:

"Effective as of 8 September 2017, section 4.2 of a CA's Certificate Policy and/or Certification Practice Statement SHALL state the CA’s policy or practice on processing CAA Records for Fully Qualified Domain Names; that policy shall be consistent with these Requirements. It shall clearly specify the set of Issuer Domain Names that the CA recognises in CAA "issue" or "issuewild" records as permitting it to issue."