{"id":3746,"date":"2017-12-08T03:41:47","date_gmt":"2017-12-08T11:41:47","guid":{"rendered":"https:\/\/cheapsslsecurity.com\/blog\/?p=3746"},"modified":"2021-02-24T23:10:55","modified_gmt":"2021-02-25T07:10:55","slug":"what-is-caa-certificate-authority-authorization-should-i-use-it","status":"publish","type":"post","link":"https:\/\/cheapsslsecurity.com\/blog\/what-is-caa-certificate-authority-authorization-should-i-use-it\/","title":{"rendered":"What is CAA (Certificate Authority Authorization)? Should I Use It?"},"content":{"rendered":"

Let\u2019s understand the technology that is a DNS CAA or Certification Authority Authorization <\/span>record and whether you should use it or not.<\/h2>\n

Quite recently, checking DNS CAA (Certificate Authority Authorization) record of a website became mandatory for all certificate authorities (CAs). It’s not a new thing, but as it wasn’t necessary, most ordinary users were unaware of this excellent technology. If you’re still in limbo about CAA, wondering what it is and what it does, you couldn’t have landed at a better place (Page, in this case!). So, let\u2019s understand what CAA is and whether you should use it or not.<\/p>\n

\"caa<\/p>\n

What is CAA or Certificate authority authorization?<\/h3>\n

There are over 30 certificate authorities (CAs) enlisted on the CAB forum. It means that a domain name holder has over thirty options to choose from. But as it goes with everything else, he\/she must have some favorites. That\u2019s where DNS CAA record comes into play.<\/p>\n

DNS CAA gives domain name holder the authority to specify and control the CA(s) that are allowed to issue SSL\/TLS certificates for that particular domain name. For example, if you have a website named domain.com and want only Comodo to issue a certificate, you can generate your CAA record, and no other CA in future can come even close to your website. You can also specify more than one CA.<\/p>\n

Keep in mind that it\u2019s become mandatory for all the CAs, not for the domain name owners. So, if you don\u2019t have such particular requirement, you don\u2019t need to do anything.<\/p>\n

Why CAA or certification authority authorization?<\/h3>\n

We hope we’ve answered your ‘What is CAA?’ question in the part above. Now, let’s have a look at why one needs to implement it. Many people struggle to classify DNS CAA. Is it a security mechanism? Is it just a control mechanism? Well, it\u2019s both. When you have such a large number of CAs at your disposal, and you only want trusted CAs to issue your certificate, CAA comes in pretty handy. You can whitelist your trusted set of CA(s), and just those CAs can issue a certificate(s) for your specified domain(s).<\/p>\n

Such control holds a great significance in larger organizations where specific purchase policies are in place. Many large corporations have websites with plenty of subdomains and have multiple SSL certificates deployed on them. But as a part of organization\u2019s policies, the certificate must be issued from a particular CA only. How would such communication amongst different departments be managed? What if a new employee, who is unaware of the policy joins in and issues a certificate from another CA? It could become a huge problem, right? Had the organization generated its CAA record, other CA couldn’t have issued the certificate, and the policy would have been maintained.<\/p>\n

How CAA works?<\/h3>\n

When someone mentions CAA, it’s not just CAA; it’s \u2018DNS CAA.’ There’s a reason behind that. The entire idea of CAA works on the Internet’s DNS (Domain Name System) \u2013 internet’s phonebook. The way it works is pretty simple. For example, you have a website named domain.com and want only a particular CA to issue certs for your domain name. What you should do is create a CAA record in your DNS with the help of our CAA record generator tool<\/a> and your DNS provider.<\/p>\n

Every DNS provider has its own method of enabling CAA record. Here are ways set by some of the most noteworthy DNS providers supporting CAA records.<\/p>\n