2 ms·
> CAA creates a DNS mechanism that enables domain name owners to whitelist CAs that are allowed to issue certificates for their hostnames. https://blog.qualys.
by darkhorn 7y ago
> CAA creates a DNS mechanism that enables domain name owners to whitelist CAs that are allowed to issue certificates for their hostnames.
https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-cabrowser-forum https://blog.qualys.com/ssllabs/2017/03/13/caa-mandated-by-c...
- tialaramex 7y agoCAA isn't relevant here. CAA is a mechanism for trustworthy CAs to agree not to issue certificates to people who don't want them. So if you set CAA to insist you only want Comodo certificates in darkhorn.example, Let's Encrypt will refuse to issue certificates for names under darkhorn.example But no matter how you set CAA for darkhorn.example, my private CA can issue certificates for it no problem. Let's Encrypt aren't _prevented_ from issuing, they are _declining_ to issue by policy, and that policy is part of why the world trusts them. But the world doesn't trust my private CA, so I don't have to follow that policy.