4 ms·
Cool. Domain-limited CAs are a really good idea, and they don't need anything like dynamic downloading of CAA records.
by lambdaone 3y ago
Cool. Domain-limited CAs are a really good idea, and they don't need anything like dynamic downloading of CAA records.
- smarnach 3y agoCAA records only apply at the time a certificate is issued, and they only need to be considered by CAs. If the CAA record is changed later, all certificates that have already been issued continue to be valid, even if the new CAA record does not allow the issuing CA anymore. So looking at CAA records would be useless for browsers anyway.