DNS CAA resource record check

After creating a CAA resource record (RR) that authorizes DigiCert to issue TLS/SSL certificates for a domain, you have effectively deauthorized all other Certificate Authorities (CAs) from issuing a certificate for that domain. The only way to authorize another CA to issue certificates for that domain is to create another CAA RR for that CA.

In this way, CAA resource records enable precise control over certificate issuance for the domain. This control prevents unauthorized Certificate Authorities from issuing certificates for your domain.

Below are valid CAA RR values that you can currently use in your CAA records to authorize DigiCert to issue your TLS/SSL certificate:

All values listed above are equivalent. In other words, you can use any of these values to allow DigiCert to issue TLS/SSL certificates for all the DigiCert certificate brands.

Do you have or are you planning to create DNS CAA RRs for your domains? Make sure that your records are up-to-date and accurate.

DigiCert recommends checking your domains' existing DNS CAA RRs before you order TLS/SSL certificates. Verify that you have the records for each CA authorized to issue TLS/SSL certificates for your domains. We also recommend understanding the process before creating new DNS CAA RRs for a domain. Don't let a misconfigured CAA RR accidentally prevent a CA from issuing a certificate needed as soon as possible.

See Edit a domain's CAA resource record.

A Certification Authority Authorization (CAA) resource record (RR) consists of a single-byte flag and a tag-value pair referred to as a property, see RFC 6844 sections 3, 5.1.

The flag is an unassigned integer between 0-255. The tag in the tag-value pair may consist of US-ASCII letters and numbers, while the value is an octet string representing the value of the tag-value property.

Use this property tag to authorize a CA (such as DigiCert) to issue certificates for yourdomain and *.yourdomain. When processing a certificate order for yourdomain or *.yourdomain, the CA queries the domain's DNS for CAA RRs containing the "issue" property tag. If the CA finds only an "issue" property tag and that tag that authorizes them to issue a certificate for the yourdomain, they can issue a certificate for yourdomain and *.yourdomain.

To authorize multiple CAs to issue certificates for yourdomain and *.yourdomain, you must create a unique CAA RR for each CA.

yourdomain CAA 0 issue "digicert.com"
yourdomain CAA 0 issue "ca2.example.com"

Use this property tag to authorize a CA (such as DigiCert) to issue a certificate for *.yourdomain. When processing a certificate order for *.yourdomain, the CA queries the domain's DNS for CAA RRs containing the "issuewild" property tag.

To authorize multiple CAs to issue certificates for *.yourdomain, you must create a unique CAA RR for each CA.

yourdomain CAA 0 issuewild "digicert.com"
yourdomain CAA 0 issuewild “ca2.example.com”

The "issuewild" property tag authorizes a CA to issue a certificate for a *.yourdomain, *.sub.yourdomain, *.sub.sub.yourdomain, etc. It does not specifically authorize or prevent a CA from issuing a certificate for yourdomain, sub.yourdomain, sub.sub.yourdomain, etc.

When correctly used, the "issuewild" property can be an effective tool for creating certificate issuance policies.

For example, you create three "issue" CAA RRs for yourdomain. Later, you decide you only want one of those CAs to issue certificates for *.yourdomain. So, you create an "issuewild" CAA RR authorizing that CA to issue a certificate for *.yourdomain. All three CAs can continue to issue certificate for yourdomain, but now only one CA can issue a certificate for *.yourdomain.