GlossarySecurity and reputation
Certificate authority
Definition
A certificate authority is the body that signs a certificate once it has verified that the requester controls the domain name. Browsers and operating systems ship with the list of authorities they trust; a certificate signed by any other triggers a warning.
What a certificate proves, and what it does not
The most common verification is automatic: the authority asks you to publish a value in the domain's DNS, or to drop a file on the site, then confirms it is there. That check, and nothing more, is what an ordinary certificate attests. It proves control of the name, not the honesty of whoever runs it — a fraudulent site can show a padlock just like anyone else.
A domain can restrict which authorities are allowed to issue for it, using a CAA record. It is a single DNS line that closes the door on the others, and it earns its place when a former provider still holds access that would let them request a certificate in the client's name.
Restricting who can issue
Two lines: the authorized authority, and the address to warn about an unexpected request.
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"Publishing a CAA record does not revoke certificates already issued: it governs future requests. Authorities are required to consult it before signing, and to refuse when the name does not authorize them.
The usual mistake
Publishing a CAA record naming a single authority, then changing host. The new one uses a different authority, its requests are refused, and the site ends up without a valid certificate while nothing in its configuration looks at fault.
How to avoid it: Read the domain's CAA record before any migration, and add the new host's authority before you switch. A forgotten DNS line will stop a certificate from being issued just as surely as a server misconfiguration.
Source: The CAA record is defined in RFC 8659. The obligation for authorities to check it before issuing is in the CA/Browser Forum Baseline Requirements.
Related terms
Where to go next
Knowing the words is half the job
The other half is knowing which of your domains is about to become a problem. DomainVigil watches expiry, DNS, certificates and reputation, and tells you before your client does.
Start for freeFive domains free, forever. No card required.