Check policy before issuing
01CAA tells a certification authority which issuers the domain holder authorizes. It is an issuance check, not a browser trust decision.
Later, a browser evaluates the issued certificate using its normal validation rules. It MUST NOT use the currently published CAA records as certificate validation or revocation data.
Key idea: Passing CAA is only one condition for issuance.
Terms
- CAA
- Certification Authority Authorization: DNS policy checked by a CA before it issues a certificate.
- CA
- Certification Authority: an issuer of certificates under a stated certificate policy.
- Relevant RRset
- The first nonempty CAA resource-record set found by the RFC’s lookup algorithm. A set can contain several properties.
- Property tag
- The case-insensitive name of a CAA property, such as issue, issuewild or iodef.
- Wildcard name
- A certificate name beginning with *., such as *.example.com. For CAA lookup, remove that leading *. first.
- CP / CPS
- Certificate Policy / Certification Practices Statement. Section 3 allows an exception specified in the relevant CP or CPS; the worked examples assume none applies.
Rules & examples
Passing CAA is only one condition for issuance.
- Before issuing, a compliant CA MUST check for a Relevant RRset. With a Relevant RRset, it MUST NOT issue unless the request is consistent with it or an exception specified in the relevant CP or CPS applies (§3). The illustrations assume no exception.
- Issuers MUST verify authorization for every fully qualified domain name and wildcard name in a request. One permitted name cannot authorize the other names on a certificate (§3).
- CAA compliance is necessary but not sufficient for issuance. Domain validation, other certificate-policy requirements and browser trust are separate. CAA does not prevent an authorized CA from mis-issuing (§§1,5.3).
- Relying Parties MUST NOT use CAA as part of certificate validation. A later CAA change need not match the policy at issuance time; it does not revoke an existing certificate (§1).
Fictional names, inert records and simulated DNS answers. The examples assume no CP/CPS exception and no extra issuer-defined parameter constraint. Passing CAA does not satisfy the other checks needed to issue a certificate.
Sources
New to this? Start hereA quick picture + helpful background
Check the domain’s issuer list before signing
Imagine a certificate printer checking a domain’s published list of permitted signing organizations. That list is only one check before printing; it is not the later reader’s test of an existing certificate. This is an analogy for issuance policy, not a complete certificate system.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.