4 ms·
If I understand correctly, you could set this to 'CAA 0 issue "example.org"' effectively preventing conforming CAs from issuing certificates for your domain. Th
by jpalomaki 10y ago
If I understand correctly, you could set this to 'CAA 0 issue "example.org"' effectively preventing conforming CAs from issuing certificates for your domain. Then if you actually need to get a new cert for the domain, you would temporarily switch the value to your certificate provider of choice.
- mnordhoff 10y agoThe standard way to do that is: example.com. CAA 0 issue ";" https://tools.ietf.org/html/rfc6844#section-5.2 https://tools.ietf.org/html/rfc6844#section-5.2