https://nalar.dev/tags/tls-certificates/ Recent content in TLS Certificates on Nalar Hugo en-us Wed, 23 Sep 2026 00:00:00 +0000 https://nalar.dev/caa-records-restrict-certificate-authority-issuance/ Wed, 23 Sep 2026 00:00:00 +0000 https://nalar.dev/caa-records-restrict-certificate-authority-issuance/ <h1 id="caa-records-restrict-certificate-authority-issuance">CAA Records Restrict Certificate Authority Issuance</h1> <p>A public certificate authority can issue a certificate only after satisfying its validation and policy requirements. DNS Certification Authority Authorization adds another control: the domain holder can publish a CAA resource record set that states which issuers are authorized for a name.</p> <p>CAA is an issuance constraint, not a replacement for domain-control validation. An authorized CA still has to perform the validation required by its certificate policy. Conversely, successful domain validation does not permit a compliant CA to disregard an applicable CAA restriction.</p>