Read property bytes and critical flags
04One flags octet and one tag-length octet precede a property tag and the remaining value bytes.
Separate case: tbs has flags0. The CA ignores that unrecognized property and evaluates the recognized issue record. CAA permits this CA to continue; other issuance checks still remain.
Key idea: Critical is the high bit: decimal 128, not 1.
Terms
- CAA
- Certification Authority Authorization: DNS policy checked by a CA before it issues a certificate.
- CA
- Certification Authority: an issuer of certificates under a stated certificate policy.
- Relevant RRset
- The first nonempty CAA resource-record set found by the RFC’s lookup algorithm. A set can contain several properties.
- Property tag
- The case-insensitive name of a CAA property, such as issue, issuewild or iodef.
- Wildcard name
- A certificate name beginning with *., such as *.example.com. For CAA lookup, remove that leading *. first.
- CP / CPS
- Certificate Policy / Certification Practices Statement. Section 3 allows an exception specified in the relevant CP or CPS; the worked examples assume none applies.
Rules & examples
Critical is the high bit: decimal 128, not 1.
- CAA is RR type 257, registered in RFC 6844 §7.1 and retained by RFC 8659 §8. Each RDATA contains one property: flags, tag length, tag bytes and remaining value bytes. There is no separate value-length byte; the value is not limited to 255 characters (§4.1.1).
- Tag length MUST be at least one. Property tags allow only ASCII letters and digits; matching is case insensitive, while canonical presentation uses lowercase. Verified erratum 5934 corrects §7: hyphens are allowed in issue/issuewild parameter names, not in the top-level property tag (§4.1).
- Bit zero is the most significant bit here, so decimal128 marks issuer-critical. Publishers MUST clear reserved flag bits; interpreting applications MUST ignore them. Decimal1 sets a reserved bit, not issuer-critical (§4.1).
- A CA MUST NOT issue if the Relevant RRset includes an unknown or unsupported critical property. Without that critical flag, an unrecognized tag does not create an issuance restriction. This does not override restrictions in recognized properties (§§3,4.5).
Fictional names, inert records and simulated DNS answers. The examples assume no CP/CPS exception and no extra issuer-defined parameter constraint. Passing CAA does not satisfy the other checks needed to issue a certificate.
Sources
New to this? Start hereA quick picture + helpful background
Check the domain’s issuer list before signing
Imagine a certificate printer checking a domain’s published list of permitted signing organizations. That list is only one check before printing; it is not the later reader’s test of an existing certificate. This is an analogy for issuance policy, not a complete certificate system.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.