CAA

2 articles

Cybersecurity 15 Sep 2026 7 min read

CAA Records Constrain Public Certificate Issuance at the DNS Boundary

CAA Records Constrain Public Certificate Issuance at the DNS Boundary A public certificate can pass every browser check after issuance even if the domain operator never intended to use the certificate authority that created it. The Web PKI has several controls for detecting or responding to bad issuance, but DNS Certification Authority Authorization (CAA) acts earlier: it gives a domain holder a way to state which issuers are permitted to create certificates for a name.

Cybersecurity DNS

Cybersecurity 14 Sep 2026 7 min read

CAA Records Narrow Certificate Issuance Authority

CAA Records Narrow Certificate Issuance Authority A public certificate authority can validate control of a domain correctly and still be the wrong authority for that domain’s operating policy. DNS Certification Authority Authorization, or CAA, addresses that gap by giving a domain operator a published way to constrain which certificate authorities are permitted to issue certificates for its names. Domain-control validation establishes that an applicant can satisfy a validation method. CAA expresses a separate authorization decision: among the public certificate authorities capable of performing validation, which ones may proceed with issuance for this domain?

Cybersecurity TLS