Domain locking

Use CertCentral domain locking to limit which of your Company's CertCentral accounts can issue certificates for your domains.

To lock a domain, you need a Certification Authority Authorization (CAA) resource record for your domain. If you are unfamiliar with CAA resource records, contact your registrar for details on how to create and update a CAA resource record.

1. In your CertCentral account, in the left main menu, go to Settings > Preferences.
2. On the Preferences page, expand Advanced Settings.
3. In the Domain lock section, check Enable domain lock for this account.
4. At the bottom of the page, select Save Settings.

You can now lock domains so only users in your account can get certificates for them.

1. In your CertCentral account, in the left main menu, go to Certificates > Domains.
2. On the Domains page, select the domain that you want to lock.
3. Scroll down to the Domain lock section on the page. Select the toggle, to move it from Disabled to Pending.
4. Copy the unique verification token.
5. Access your registrar's CAA resource record.
6. In your domain's CAA resource record, put the unique verification token in the record and save the updated record.
   • Example of where to place the token in the CAA resource record:
     • Value: digicert.com; account=fce9431ca2df7ae0d25a6de09587fdc1ff1616e7187655a18eb72723a0b85c86
     • "digicert.com" is the value for the CA that you authorize to issue your certificates.
     • fce9431ca2df7ae0d25a6de09587fdc1ff1616e7187655a18eb72723a0b85c86" is the DigiCert generated random value token that you got from your CertCentral account.
     • "account=" must be included in front of the random value.

You locked the domain. Only users in your account can get certificates for this domain. If you want another account to order certificates for this domain, add their unique verification token to the CAA resource record.

Topics

• DNS CAA resource record check