How Does a CAA Record Restrict Certificate Issuance?

You may want to specify through DNS which certificate authorities may issue certificates for your domain. A CAA record, short for Certification Authority Authorization, lets you define that authorization rule. This guide covers where CAA records are searched, the issue and issuewild tags, empty issue values, and the limits of critical tags. It helps you read your DNS record before requesting a certificate.

At a glance

• A CAA record allows a domain holder to specify the certificate authorities authorized to issue certificates for that domain.
• A compliant certificate authority checks the relevant CAA record set before issuance. CAA conformance is necessary, but not sufficient on its own.
• The issue tag is a rule for certificates containing an FQDN. For a wildcard request, issue still applies when issuewild is absent; when issuewild is present, it takes precedence for that wildcard request.
• Where an unknown or unsupported tag is critical, a CA must not issue for that FQDN.

What does a CAA record change?

A CAA record allows a DNS domain holder to specify the CAs authorized to issue certificates for that domain. Conformance with a published CAA record is necessary for a CA to issue a certificate, but it is not sufficient by itself. In other words, CAA expresses an authorization rule for a CA; it does not mean that a certificate will necessarily be issued.

Before issuing a certificate, a compliant CA must check whether the relevant CAA record set has been published. If a record set exists, the CA must not issue the certificate unless the request is consistent with its rules or an exception defined in the relevant CA's Certificate Policy or Certification Practice Statement applies. For that reason, do not interpret a CAA result as an automatic rejection in every circumstance. [Source]

• CA: A certificate authority that issues certificates.
• CAA record set: The complete set of CAA records at a DNS name.
• CP/CPS: The CA's Certificate Policy or Certification Practice Statement documents.

Source: [1]

Which CAA record does a CA check?

The CAA search starts at the domain name in the certificate request and moves upward through the DNS name tree until it finds a CAA record set. The DNS root is not included in this search. This means that not only the record at the requested fully qualified domain name, but also a record at a parent name, can affect the certificate request.

Example scenario: suppose a certificate is requested for shop.example.com. If there is no CAA record set at shop.example.com, the search continues toward example.com. If a CAA record set is found at example.com, that set is evaluated as the relevant record set. This example shows why you should consider subdomains before changing a CAA rule at a parent name.

Source: [1]

Record format: flags, tag and value

The canonical CAA record format is CAA flags tag value. Flags is an unsigned integer from 0 to 255. Each CAA record contains one property, meaning one tag-value pair. An FQDN can have multiple CAA records, and the same property tag can appear in more than one of those records.

In this format, flags is the flag value, tag is the property label, and value is the value carried by the tag. When using multiple CAA records, remember that each record carries one tag-value pair and that the relevant record set is evaluated together.

• flags: The record's flag value; an unsigned integer from 0 to 255.
• tag: The property label, such as issue or issuewild.
• value: The value carried by the tag.

Source: [1]

Using issue to state certificate authority authorization

When the issue tag is present in the relevant CAA record set, it is an authorization request for certificates containing the requested FQDN. It asks the CA to perform CAA issue restriction processing and grants authorization to issue to the holder of the issuer-domain-name, or to a party acting under that holder's explicit authority.

When issue is used with an empty issuer-domain-name, the FQDN owner can request that no organization issue a certificate. This does not mean issuance is unrestricted because no CA name was entered; it is a request for no issuance.

The issue tag is not limited to non-wildcard certificates. For a request for a certificate containing a wildcard domain name, issue rules are evaluated if the relevant record set has no issuewild property. If issuewild is present, it takes precedence over issue for the wildcard request.

Example scenario: if you do not want issuance for example.com to be open to any organization during a particular period, you may consider an issue rule with an empty issuer-domain-name. Before applying it, review which names the relevant CAA search will affect and review your certificate renewal plan.

Source: [1]

issuewild precedence for wildcard certificates

A Wildcard Domain Name is a domain name beginning with an asterisk and a dot, such as *.example.com. The issuewild tag has the same syntax and semantics as issue, but it grants authorization only for certificates containing wildcard domain names.

If the relevant record set contains at least one issuewild property, issuewild rules take precedence over issue rules for a request for a certificate containing a wildcard domain name. In that situation, issue rules are not evaluated for the wildcard request. If issuewild is absent, however, a wildcard certificate request is not independent of issue: issue rules continue to apply.

For this reason, do not assume that an ordinary domain certificate and a wildcard certificate have the same authorization rule. If you plan a certificate for *.example.com, check whether the relevant record set contains issuewild and, if it does not, review the issue rules as well.

Source: [1]

Unknown tags, DNSSEC and the limit of CAA

If the relevant record set contains no tag that restricts issuance, CAA does not restrict issuance. Examples include a record set containing only iodef tags or tags unknown to the CA. However, a separate rule applies when an unknown tag is marked critical.

The critical flag is defined by bit 0 in the flags field. If the relevant record set contains a critical property tag that the CA does not know or support, the CA must not issue for that FQDN. If you are considering an unfamiliar tag, check not only the tag name but also whether the flags value creates critical behavior.

DNSSEC is a mechanism for authenticating DNS records. The RFC strongly recommends DNSSEC to authenticate CAA records, but does not require it. Even when DNS records are unsigned, a CA must not issue a certificate that conflicts with the relevant CAA record set.

CAA is a useful authorization layer, but it does not prevent mis-issuance by a CA that CAA authorizes. If you also want to review the other roles of DNS records, read DNS records explained: A, CNAME, MX and TXT and consider those basic record types separately from CAA.

Source: [1]

Practical checklist

• Starting at the requested FQDN, check for the CAA record set at parent domain names.
• Review issue rules for certificates containing the FQDN.
• For a certificate request containing a wildcard domain name, check whether issuewild is present.
• Confirm that issue rules still apply to a wildcard request when issuewild is absent.
• Confirm that issuewild takes precedence over issue when it is present for a wildcard request.
• Confirm that an issue record with an empty issuer-domain-name requests no issuance.
• For unknown tags, check the flags value and whether the tag is critical.
• Allow for the fact that CAA conformance is necessary but not sufficient, and do not treat CAA as a mechanism that by itself prevents mis-issuance by an authorized CA.

A CAA record lets you state certificate issuance authority for your domain through DNS. First identify where the relevant CAA record set is found. Then review the issue rules: for a wildcard request, they continue to apply when issuewild is absent; when issuewild is present, it takes precedence and issue is not evaluated for that wildcard request. Remember that an empty issue value requests no issuance, that an unknown critical tag prevents issuance, and that CAA does not by itself prevent mis-issuance by an authorized CA.

Frequently asked questions

Does a CAA record guarantee that a certificate will be issued?

No. Conformance with a published CAA record is necessary for issuance, but it is not sufficient on its own.

What does an empty issue value mean?

When issue is used with an empty issuer-domain-name, the FQDN owner requests that no organization issue a certificate.

Does an issue rule apply to a wildcard certificate request?

Yes. If the relevant record set has no issuewild property, issue rules also apply to a request for a certificate containing a wildcard domain name. If issuewild is present, it takes precedence and issue rules are not evaluated for that wildcard request.

Does a CAA tag unknown to the CA always restrict a certificate?

No. An unknown non-critical tag may not restrict issuance. If an unknown or unsupported tag is critical, the CA must not issue for that FQDN.

Sources

[1] rfc8659.txt