Module 5 · 5.2
CAA: who's allowed to issue certificates?
Module 5: Other records · Reading time: 6 minutes
Learning objective: After this lesson, you'll be able to read a CAA record and know how a CAA record can block an SSL certificate request.
Key concepts: CAA, issue, issuewild, iodef, certificate authority (CA), no CAA record means: anyone is allowed
A padlock from a stranger
An SSL certificate (actually a TLS certificate) is what gives you the padlock in the browser. It's issued by a certificate authority, or CA for short: for example Let's Encrypt, Sectigo, DigiCert or Google Trust Services. There are dozens of CAs that browsers trust, and in principle any of them may issue a certificate for your domain, as long as the applicant shows that they manage the domain.
A CAA record (Certification Authority Authorization, RFC 8659) lets you restrict that. You set out in the DNS which CAs are allowed to issue certificates for your domain. Every CA is required to check that record before issuing a certificate. If the CA isn't listed, it must refuse.
This protects against a certificate being issued in your name by a careless or misled CA. It's an extra lock, not a requirement.
What a CAA record looks like
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issue "sectigo.com"
example.com. 3600 IN CAA 0 iodef "mailto:beveiliging@example.com"A CAA record has three parts:
| Part | Example | Meaning |
|---|---|---|
| Flag | 0 | Almost always 0. A 128 means: "if you don't understand this rule, don't issue anything". |
| Tag | issue | What kind of rule it is (see below). |
| Value | "letsencrypt.org" | The CA, identified by its own domain name. In quotation marks. |
The three tags you'll come across:
issue: this CA may issue ordinary certificates (forexample.com,www.example.comand so on).issuewild: this CA may issue wildcard certificates (*.example.com). If there's noissuewild, theissuerules apply to wildcards too.iodef: where a CA can send a report if someone requests a certificate that your CAA doesn't allow.
You can have multiple issue rules: each named CA is then allowed. If you want to make sure that no one issues a particular kind of certificate, use an empty value: 0 issuewild ";" means "no one is allowed to issue wildcards".
No CAA record: anyone is allowed
If your domain has no CAA record, any CA may issue a certificate. That's the normal situation for most domains, and it's not wrong. CAA is a choice.
A CA looks up the CAA record at the exact name of the certificate. If it finds nothing there, it looks one level higher, up to the domain. So a CAA record on example.com also applies to shop.example.com, unless shop.example.com has its own CAA record.
How CAA can block your certificate
This is why CAA belongs in a beginners' course: a CAA record can stop your free certificate from being renewed, and the error message isn't always clear.
Say your website ran for years with a certificate from a paid CA. Someone created a CAA record at the time:
example.com. CAA 0 issue "sectigo.com"Now you move to hosting that automatically requests Let's Encrypt certificates. Let's Encrypt checks CAA, sees that only Sectigo is allowed, and refuses. Your site doesn't get a certificate and visitors see a warning.
The solution: add the CA you now use, or remove the old CAA record if you no longer need it.
example.com. CAA 0 issue "sectigo.com"
example.com. CAA 0 issue "letsencrypt.org"If you use a service that arranges certificates itself, such as an online store platform or a CDN, ask which CA it uses and add that. Otherwise you'll end up blocking their certificate too.
In practice: what it looks like in a panel
As an example, we'll use the DNS screen in My WebOké, which has a CAA helper with the best-known CAs. In DirectAdmin, Cloudflare and most other panels, you fill in the same three fields: flag, tag and value.
- Click Add Record and choose CAA.
- Leave the name on the domain itself (
@). - Leave the flag at
0. - Choose the tag
issue. - Enter the CA, for example
letsencrypt.org. - Save and repeat for every CA that's allowed to issue.
Summary
- A CAA record lets you decide which certificate authorities may issue certificates for your domain.
issueis for ordinary certificates,issuewildfor wildcards,iodeffor reports.- No CAA record means: any CA is allowed. That's normal.
- A CAA record on the domain also applies to subdomains without their own CAA.
- A forgotten CAA record can block a new or renewed certificate. Add the CA you currently use.
Quiz
Exercise
Exercise Z5.2: Looking up CAA. Look up the CAA records of wikipedia.org. Which certificate authorities are allowed to issue certificates according to the issue rules? Enter them all.
Exercise O5.2: Setting it up yourself in your practice zone. In your practice zone, on the name of the zone itself (@), create two CAA records:
0 issue ";"0 iodef "mailto:abuse@dnspractice.eu"
The first rule means: no one is allowed to issue certificates for this name. In the practice zone, that's exactly right: there's no real website running, so no certificate should be issued either, and this way no one can misuse the practice zone to get a certificate. On your real domain, you'd never do this if you use https; there you set the CAs you actually use, such as 0 issue "letsencrypt.org". The iodef rule in the practice zone points to the report address of the practice environment; on your real domain, you fill in your own address.
Then click Check.
Exercise O5.2
You'll do this exercise in your own practice zone: a real DNS zone on WebOké's nameservers, just for you. Sign up with your email address. You'll get a login link by email and then come back to this lesson. We only use your address for the course.
Further reading
These articles describe the steps in WebOké's panels; in other panels they work in a similar way.