IPFYI
RFC 8659 Proposed Standard

DNS Certification Authority Authorization (CAA) Resource Record

P. Hallam-Baker, R. Stradling, J. Hoffman-Andrews · 2019-11

Abstract

The Certification Authority Authorization (CAA) DNS Resource Record allows a DNS domain name holder to specify one or more Certification Authorities (CAs) authorized to issue certificates for that domain or wildcard domain. CAA Resource Records allow a public CA to implement additional controls to reduce the risk of unintended certificate mis-issuance.

Why This RFC Matters

RFC 8659 updated the CAA record specification (originally RFC 6844) and made CAA checking a mandatory step in the CA/Browser Forum Baseline Requirements for all publicly trusted CAs — meaning no CA may issue a certificate for a domain if a conflicting CAA record is present. A domain owner publishing `0 issue "letsencrypt.org"` in DNS effectively prevents any other CA from issuing certificates for that domain, providing a significant defense against certificate mis-issuance by rogue or compromised CAs. CAA is now a standard security hygiene measure audited by web security scanners and recommended by every major security framework.

관련 프로토콜

DNS SSL-TLS HTTPS DNSSEC

관련 용어

certificate ssl-tls authentication dns encryption

Security에서 더 보기

RFC 2404 The Use of HMAC-SHA-1-96 within ESP and AH RFC 3602 The AES-CBC Cipher Algorithm and Its Use with IPsec RFC 4253 The Secure Shell (SSH) Transport Layer Protocol RFC 4254 The Secure Shell (SSH) Connection Protocol RFC 4301 Security Architecture for the Internet Protocol RFC 5246 The Transport Layer Security (TLS) Protocol Version 1.2 RFC 5280 Internet X.509 Public Key Infrastructure Certificate and CRL Profile RFC 6125 Representation and Verification of Domain-Based Application Service Identity within Internet Public Key Infrastructure Using X.509 (PKIX) Certificates in the Context of Transport Layer Security (TLS)