CAA Record (Certification Authority Authorization)
O que é CAA Record (Certification Authority Authorization)?
CAA Record (Certification Authority Authorization)A DNS record type (RFC 8659) that lets a domain owner restrict which Certificate Authorities are allowed to issue certificates for the domain, blocking accidental or malicious mis-issuance by other CAs.
A CAA record (Certification Authority Authorization, originally RFC 6844 and updated by RFC 8659) is a DNS resource record that lets a domain owner enumerate exactly which CAs may issue certificates for the domain. The record carries three fields: a flag byte, a property tag (`issue`, `issuewild`, `iodef`), and a value (typically a CA's issuer name such as `letsencrypt.org` or `digicert.com`). Since September 2017, all CAB Forum-trusted public CAs are required by the Baseline Requirements to check CAA records before issuing certificates and to refuse issuance if the record forbids them. A typical hardened deployment looks like `example.com. CAA 0 issue "letsencrypt.org"; example.com. CAA 0 issuewild ";"; example.com. CAA 0 iodef "mailto:security@example.com"`. The third record asks misbehaving CAs to report any rejected issuance attempt. CAA significantly reduces the risk of cert mis-issuance — by typosquatted domains, by hijacked CA accounts, by lookalike-CAs in obscure trust stores — and is one of the simplest single-record web-hygiene wins available. It pairs naturally with Certificate Transparency monitoring.
● Exemplos
- 01
An organization publishes `CAA 0 issue "letsencrypt.org"` so that no other public CA can issue end-entity certificates for the domain.
- 02
A CT-monitoring alert fires on a certificate issued for the domain by a CA not listed in its CAA records, indicating either a misconfiguration or a CA non-compliance event.
● Perguntas frequentes
O que é CAA Record (Certification Authority Authorization)?
A DNS record type (RFC 8659) that lets a domain owner restrict which Certificate Authorities are allowed to issue certificates for the domain, blocking accidental or malicious mis-issuance by other CAs. Pertence à categoria Segurança de rede da cibersegurança.
O que significa CAA Record (Certification Authority Authorization)?
A DNS record type (RFC 8659) that lets a domain owner restrict which Certificate Authorities are allowed to issue certificates for the domain, blocking accidental or malicious mis-issuance by other CAs.
Como funciona CAA Record (Certification Authority Authorization)?
A CAA record (Certification Authority Authorization, originally RFC 6844 and updated by RFC 8659) is a DNS resource record that lets a domain owner enumerate exactly which CAs may issue certificates for the domain. The record carries three fields: a flag byte, a property tag (`issue`, `issuewild`, `iodef`), and a value (typically a CA's issuer name such as `letsencrypt.org` or `digicert.com`). Since September 2017, all CAB Forum-trusted public CAs are required by the Baseline Requirements to check CAA records before issuing certificates and to refuse issuance if the record forbids them. A typical hardened deployment looks like `example.com. CAA 0 issue "letsencrypt.org"; example.com. CAA 0 issuewild ";"; example.com. CAA 0 iodef "mailto:security@example.com"`. The third record asks misbehaving CAs to report any rejected issuance attempt. CAA significantly reduces the risk of cert mis-issuance — by typosquatted domains, by hijacked CA accounts, by lookalike-CAs in obscure trust stores — and is one of the simplest single-record web-hygiene wins available. It pairs naturally with Certificate Transparency monitoring.
Como se defender contra CAA Record (Certification Authority Authorization)?
As defesas contra CAA Record (Certification Authority Authorization) costumam combinar controles técnicos e práticas operacionais, conforme detalhado na definição acima.
Quais são outros nomes para CAA Record (Certification Authority Authorization)?
Nomes alternativos comuns: Certification Authority Authorization, CAA DNS record.
● Termos relacionados
- network-security№ 174
Autoridade de certificação (CA)
Entidade de confiança que emite e assina certificados digitais, ligando chaves públicas a identidades verificadas, como nomes de domínio ou organizações.
- defense-ops№ 177
Transparencia de certificados
Ecossistema de logs publicos append-only de certificados TLS, definidos nas RFC 6962 e 9162, que permite auditar que certificados existem para qualquer dominio.
- network-security№ 981
Infraestrutura de Chave Pública (PKI)
Conjunto de políticas, software, hardware e autoridades de confiança que emite, distribui, valida e revoga certificados digitais que ligam identidades a chaves públicas.
- network-security№ 380
DNSSEC
Conjunto de extensões do DNS que utiliza assinaturas digitais para permitir que os resolvedores verifiquem a autenticidade e a integridade dos registos DNS.
- network-security№ 1385
Certificado X.509
Estrutura padrão de certificado digital que liga uma chave pública a uma identidade através da assinatura de uma autoridade de certificação de confiança.
- network-security№ 444
Certificado de validação alargada (EV)
Certificado TLS emitido apenas após a CA realizar uma verificação rigorosa e padronizada da identidade legal, existência física e autoridade da organização requerente.