Skip to content

Check out zerohook.org

What is / Full version

CAA

CAA tells a public CA which issuers may mint a certificate for the name. It is not a check a TLS client runs on a presented certificate.

Short answer

Before issuance

Before issuing a certificate, a compliant CA must check for a Relevant RRset. If that set exists, the CA must not issue unless the request is consistent with it, or an exception in the CA's CP or CPS applies.

Relying Parties must not use CAA records as part of certificate validation. A certificate that does not match today's CAA may still have matched the CAA that was published when it was issued.

issue and issuewild

RFC 8659's example that authorises two CAs is certs.example.com CAA 0 issue "ca1.example.net" and CAA 0 issue "ca2.example.org". issue ";" grants no issuer.

issuewild has the same syntax as issue but only for a wildcard name. If any issuewild is present for that wildcard request, every issue property is ignored for that request.