CAA-record opsætning

CAA-record

What is a CAA record

a CAA record (Certificate Authority Authorization) is a DNS record added to a domain or subdomain, which tells which issuers are allowed to issue certificates on that level and all sub levels to it.

Alle issuers are required to look up CAA records before they issue anything on the domain.

Check used CA

Before setting up CAA records you should check which issuers are being used. If a subcontractor or a service like cloudflare is using a Let's Encrypt certificate, this can't be renewed if a CAA record is set up that excludes Let's Encrypt.

You can see all public certificates at https://crt.sh. % acts as a wildcard, e.g. %.fairssl.dk shows all certificates for fairssl.dk

Tags

There are 3 DNS tags that is used for CAA records, and it's possible to add multiple records to achieve the desired policy.

If there are no CAA records on the domain that fits the DNS names the certificate is being issued to, this will allow all CAs to issue the certificate.

issue

Create a "CAA issue" record for every CA that should be permitted to issue certificate with one or more specific names, also called FQDN (Fully Qualified Domain Name), e.g. www.fairssl.dk. If there is not at least one "CAA issuewild" if will also allow wildcard SAN names. e.g. *.fairssl.dk

issuewild

Create a "CAA issuewild" record for every CA that should be permitted to issue certificates with one or more wildcard SAN names, e.g. *.fairssl.dk.

Be aware that most wildcard certificates contains both the wildcard name and a specific DNS name (FQDN), e.g. fairssl.dk, so typically both an issue and an issuewild is required to make a wildcard.

If you wish to prevent all CAs from issuing certificates or wildcard certificates on a domain, you can create an empty issue or issuewild record by adding a semicolon instead of a CA.

iodef

Create a "CAA iodef" with a URL or mailto:email-address which the CAs can report to in case someone tries to issue a certificate that violates the CAA policy that is active at that moment.

Most used CA tag names

Here are the most used CA tag values, used to describe if a CA can issue certificates for the domain.

Several brands can belong to the same CA, and therefore have the same tag.

Tag value - Brands

digicert.com - DigiCert, GeoTrust, Thawte, RapidSSL

globalsign.com - GlobalSign, AlphaSSL

sectigo.com - Sectigo, Comodo

entrust.net - Entrust

letsencrypt.org - Let's Encrypt

godaddy.com - GoDaddy

Examples

Allow all FairSSL CA

This policy will allow both standard and wildcard issues from the following CAs on fairssl.dk and all sub domains, and block every other CA:

GlobalSign

AlphaSSL

DigiCert

RapidSSL

Thawte

GeoTrust

Symantec

Sectigo

Comodo

iodef is a URL/mail address which the CAs can contact in case they notice any violations of the CAA policy.

fairssl.dk CAA 0 issue "globalsign.com"

fairssl.dk CAA 0 issue "digicert.com"

fairssl.dk CAA 0 issue "sectigo.com"

fairssl.dk CAA 0 iodef "mailto:info@fairssl.dk"

Allow specific names but not wildcards

This policy will allow specific name certificates from Sectigo and Comodo for vpn.fairssl.dk and all sub domains to it, and block all other CAs.

No CA is allowed to issue wildcards for vpn.fairssl.dk or any sub domain to it.

vpn.fairssl.dk CAA 0 issue "sectigo.com"

vpn.fairssl.dk CAA 0 issuewild ";"

Allow DigiCert with wildcard and Let's Encrypt without

This policy allows specific name certificates from Let's Encrypt, but not wildcards, and it allows all certificates from DigiCert, and it's related brands like RapidSSL and Thawte.

This blocks all other CAs.

fairssl.dk CAA 0 issue "letsencrypt.org"

fairssl.dk CAA 0 issue "digicert.com"

fairssl.dk CAA 0 issuewild "digicert.com"

Google Cloud / Route 53 example

This is how a policy looks in Cloud DNS or AWS Route53:

This policy will give DigiCert, GlobalSign and Sectigo permission to issue standard certificates and block every CA from issuing wildcards on fairssl.dk and all sub domains. Violations can be reported to caa-feedback.fairssl.dk

BIND DNS fra 9.9.6

This is how a policy looks in BIND DNS version 9.9.6 and higher:

This policy will give DigiCert, GlobalSign and Sectigo permission to issue standard certificates and block every CA from issuing wildcards on fairssl.dk and all sub domains.

GratisDNS

Here is shown how to set up CAA records in GratisDNS.

1. Login to your GratisDNS control panel.

2. Click DNS in the top bar.

3. Click Ændre next to the domain you wish to add a CAA record to.

4. Click Tilføj CAA record.

5. Enter the hostname for the CAA record in Host e.g. fairssl.dk.

Flags should always be 0 (zero).

Enter the tag you want to make the record for in Tag i.e. issue, issuewild or iodef.

Enter the value you want for the record in Value, the CA's address for issue and issuewild, the URL/mail for iodef.

Set TTL to 3600.

You need to make individual records for each CA which is to be permitted to issue certificates.