https://nalar.dev/tags/certificate-issuance/ Recent content in Certificate Issuance on Nalar Hugo en-us Tue, 15 Sep 2026 00:00:00 +0700 https://nalar.dev/caa-records-constrain-public-certificate-issuance-at-the-dns-boundary/ Tue, 15 Sep 2026 00:00:00 +0700 https://nalar.dev/caa-records-constrain-public-certificate-issuance-at-the-dns-boundary/ <h1 id="caa-records-constrain-public-certificate-issuance-at-the-dns-boundary">CAA Records Constrain Public Certificate Issuance at the DNS Boundary</h1> <p>A public certificate can pass every browser check after issuance even if the domain operator never intended to use the certificate authority that created it. The Web PKI has several controls for detecting or responding to bad issuance, but DNS Certification Authority Authorization (CAA) acts earlier: it gives a domain holder a way to state which issuers are permitted to create certificates for a name.</p>