3 ms·

Any CA can issue certificates for any domain, but they may not be permitted to do so. Certification Authority Authorization (CAA) DNS records can be used to in

by zjs 8y ago

Any CA can issue certificates for any domain, but they may not be permitted to do so. Certification Authority Authorization (CAA) DNS records can be used to indicate which CA is authorized to issue certificates for a domain. The CA/Browser Forum requires all certificate authorities to check CAA records prior to issuance.

netheril96 8y ago
> The CA/Browser Forum requires all certificate authorities to check CAA records prior to issuance. And what if a CA fails to check CAA records? Revoke their status as an authority? By then attackers may have already obtained highly confidential information from DoD sites.