Find the first relevant record set
02Search the requested name and then its parents, stopping at the first nonempty CAA answer.
The search stops at example.com. A different record at com would not be added. If every level through com were empty, the result would be empty without querying the root.
Key idea: Do not merge CAA policies from different ancestors.
Terms
- CAA
- Certification Authority Authorization: DNS policy checked by a CA before it issues a certificate.
- CA
- Certification Authority: an issuer of certificates under a stated certificate policy.
- Relevant RRset
- The first nonempty CAA resource-record set found by the RFC’s lookup algorithm. A set can contain several properties.
- Property tag
- The case-insensitive name of a CAA property, such as issue, issuewild or iodef.
- Wildcard name
- A certificate name beginning with *., such as *.example.com. For CAA lookup, remove that leading *. first.
- CP / CPS
- Certificate Policy / Certification Practices Statement. Section 3 allows an exception specified in the relevant CP or CPS; the worked examples assume none applies.
Rules & examples
Do not merge CAA policies from different ancestors.
- For a request for X or *.X, start the search at X. A wildcard certificate request does not cause a CAA query for the literal *.X name (§3).
- CAA(domain) is a CAA record query that follows DNS aliases normally. If its result is empty, remove the leftmost label of the name being searched and try again. Stop before querying the DNS root dot (§3).
- The first nonempty CAA RRset is the Relevant RRset. Do not combine its properties with CAA records at higher ancestors. Multiple records within that one set can still be additive (§§3,4.2).
- Even an iodef-only or unknown-noncritical-only RRset stops the search; without applicable issuance restrictions it does not restrict issuance. An unknown critical property is a separate mandatory stop (§§3,4.5).
Fictional names, inert records and simulated DNS answers. The examples assume no CP/CPS exception and no extra issuer-defined parameter constraint. Passing CAA does not satisfy the other checks needed to issue a certificate.
Sources
New to this? Start hereA quick picture + helpful background
Check the domain’s issuer list before signing
Imagine a certificate printer checking a domain’s published list of permitted signing organizations. That list is only one check before printing; it is not the later reader’s test of an existing certificate. This is an analogy for issuance policy, not a complete certificate system.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.