I got this from Feisty Duck's Cryptography & Security Newsletter: The baseline version of CAA has been mandatory since September 2017, but it's insufficient for our needs. There is another document (RFC 8657) that bridges the ACME protocol for automated certificate issuance and CAA, adding support…

Let's Encrypt has implemented this and enabled it on production: [image] Enabling ACME CAA Account and Method Binding API Announcements T… [image] Rip: What I can not yet prove is whether Let's Encrypt will actually enforce accounturi and validationme…

See relevant announcements: [image] ACME-CAA "validationmethods" support API Announcements O… [image] Enabling ACME CAA Account and Method Binding API Announcements T…

@MikeMcQ sent me this link: [image] The validationmethods parameter - Certificate Authority Authorization (CAA) CAA is a type of DNS record that allows site owners to specify which Certificate Authorities (CAs) are allowed to issue certificates containing their domain names. It was first…

That's a fair point. When I wrote that, I hadn't yet found Let's Encrypt's 2018 staging announcement or the 2022 production rollout announcement for ACME CAA Account and Method Binding. My test only verified the "allowed" path: I published accounturi and validationmethods=dns-01, then successfully…

Follow-up: I performed a negative test using a different Let's Encrypt ACME account and attempted issuance for banger.riptidetech.io while the parent domain's CAA policy restricted issuance to account 223017260. Let's Encrypt rejected the request with: CAA record for riptidetech.io prevents issuanc…

@Rip Where's the whole "mandatory" part from the thread title exactly?

The CA/Browser Forum has voted to make ACME CAA extensions mandatory starting in March 2027. This change is one of the last remaining pieces needed to support strong, cryptographically-validated domain validation in Web PKI ACME CAA Extensions to Become Mandatory | Feisty Duck …

Thnx. So the relevant CA/B Forum ballot seems to be Ballot SC098v2: Process RFC 8657 CAA Parameters | CA/Browser Forum (that Feisty Duck has a lot of words but for me the only interesting and relevant piece was the ballot :stuck_out_tongue:) So in essence this is just a mandatory requirement for C…

[image] Osiris: There is NO need for users to do anything if they wish to NOT use CAA or NOT use the CAA parameters. That is also important to know. Thanks.

Yup, it's just that CAs need to check for them.

ACME CAA Extensions to Become Mandatory

Issuance Policy

dextercd May 29, 2026, 7:20pm 2

Let's Encrypt has implemented this and enabled it on production:

Wait until March 2027? Surely you could've tested it by putting different values in accountur/validationmethods and seeing if it triggers and error?

Topic		Replies	Views
Enabling ACME CAA Account and Method Binding API Announcements	2	13748	December 16, 2022
ACME-CAA "validationmethods" support API Announcements	5	8368	September 25, 2018
PROD Support for RFC8657 CAA constraints for accountURI and validationmethods Feature Requests	22	2542	July 23, 2022
Re: Enabling ACME CAA Account and Method Binding Praise	25	2507	December 18, 2022
Approve Let's Encrypt certs Feature Requests	11	1302	April 29, 2023

ACME CAA Extensions to Become Mandatory

Related topics