Web & certificates

What is CAA? Certification Authority Authorization explained

A CAA record defines which certificate authorities may issue certificates for a domain. All public certificate authorities must check it before issuing.

How CAA works

With issue, the CAA record names the certificate authorities allowed for regular certificates, and with issuewild those for wildcard certificates. Without a CAA record, any certificate authority may issue.

With iodef you set an address to which certificate authorities can report refused requests. Checking CAA has been mandatory for public certificate authorities since September 2017.

CAA applies to the domain and its subdomains: if a subdomain has no CAA record of its own, the next one up applies. The Domain Trust Check also checks whether the certificate authority of the current certificate is allowed.

Example

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issuewild ";"
example.com.  CAA  0 iodef "mailto:security@example.com"

Only Let's Encrypt may issue; wildcard certificates are forbidden entirely.

Common mistakes

The hosting provider's certificate authority is missing from the CAA record – the next automatic renewal fails.
A typo in the certificate authority's name (e.g. "letsencrypt.com").
A forgotten CAA record on a subdomain overrides the rule of the main domain.

How the Domain Trust Check rates CAA

Criterion “CAA” (weight 4 of 5): CAA record with issue and issuewild entries, iodef report address and whether the CA of the current certificate is allowed.

Standard: RFC 8659