# CAA "issuewild" question **URL:** \ **Category:** Issuance Policy\ **Created:** [September 1, 2021, 7:17pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018 "2021-09-01T19:17:08Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [September 1, 2021, 7:17pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018/1 "2021-09-01T19:17:08Z")
Given: A domain that has only CAA records for "issue" [having no records for "issuewild"]. Is the default behavior **to allow** any CA to issue wildcard certs for said domain or for none to? [the [RFC (8659)](https://www.rfc-editor.org/rfc/rfc8659.html) seems to lean towards the ~~"allow any"~~ (issuewild follows issue) unless otherwise specifically limited] ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [September 1, 2021, 7:26pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018/2 "2021-09-01T19:26:16Z")
None of the two options you've given. The `issue` CAA property is for regular certificates as wel as wildcard certificates. The `issuewild` only let's you _specifically_ select a CA for wildcard certificates and takes precedence over the `issue` property, but the lack of an `issuewild` property still makes the `issue` property valid for wildcard certificates too. So if you _only_ have an `issue` property you _only_ grand issuance of wildcard certificates to _that_ CA. ---
**Author:** ![rg305](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/rg305/32/91314_2.png) [@rg305](https://community.letsencrypt.org/u/rg305)\ **Post date:** [September 1, 2021, 7:32pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018/3 "2021-09-01T19:32:26Z")
> [@Osiris](#): > > If you _only_ have an `issue` property you _only_ grant issuance of wildcard certificates to _that_ CA. OK, so then is this how LE implements the RFC (8659)? Are other CAs able to implement it in any other way? [should I update my CAA records to include "issuewild" constraints?] You didn't explicitly say that I could... so I won't. OR You didn't explicitly say that I couldn't... so I will. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [September 1, 2021, 7:42pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018/4 "2021-09-01T19:42:11Z")
> [@rg305](#): > > OK, so then is this how LE implements the RFC (8659)? You can see the issue/issuewild logic here: > It uses the `issue` set of properties of a CAA record by default _unless_ the certificate is a wildcard certificate **and** there is one or more `issuewild` properties in the CAA record present. If not, it just uses the default of `issue` properties. > [@rg305](#): > > Are other CAs able to implement it in any other way? I'm pretty sure that would violate the BR. Article 3.2.2.8 of the current BR (1.8.0) only specifies that the CA needs to adhere to RFC 8659. > [@rg305](#): > > [should I update my CAA records to include "issuewild" constraints?] Depends what you want to achieve with that? > [@rg305](#): > > You didn't explicitly say that I could... so I won't. > OR > You didn't explicitly say that I couldn't... so I will. Those are the exact two options you've listed in your OP whereas there is a third option: "If no issuewild property has been set, the CA needs to abide to the issue property/properties for wildcard certificates". ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [September 1, 2021, 8:14pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018/5 "2021-09-01T20:14:35Z")
Look through the examples in RFC 8659 section 4.3; I think they're reasonably clear on the scenario you present. > The following RRset requests that only [ca1.example.net](http://ca1.example.net) issue certificates for "[wild2.example.com](http://wild2.example.com)", "\*.wild2.example.com", or "\*.sub.wild2.example.com". > > > ``` > > wild2.example.com CAA 0 issue "ca1.example.net" > > > > ``` > [@rg305](#): > > Are other CAs able to implement it in any other way? No, any publicly-trusted CA that didn't strictly follow the CAA standard would be a Bad Thing and would be considered an [Official Incident](https://bugzilla.mozilla.org/buglist.cgi?short_desc_type=allwordssubstr&query_format=advanced&v3=delayed-revocation&o3=nowordssubstr&short_desc=CAA&f2=status_whiteboard&resolution=FIXED&f4=CP&f1=OP&v2=ca-compliance&component=CA%20Certificate%20Compliance&o2=allwordssubstr&f3=status_whiteboard). > [@rg305](#): > > should I update my CAA records to include "issuewild" constraints? Well, I suppose if you use the same CAs for non-wildcard and wildcard certs, then probably having only "issue" entries is fine. I don't currently use wildcard certs, so I have an `issuewild ";"` in my domain name, "just in case". I'm generally in favor of trying to make this kind of thing as clear and explicit as possible. Though, I just looked at a handful of popular domains just now (like, just the first dozen or so names I happened to think of), and most of them had CAA set up but only with "issue" records and no "issuewild" records. so I think ignoring the existence of issuewild when making one's CAA record is fairly common. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [September 1, 2021, 8:49pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018/6 "2021-09-01T20:49:33Z")
> [@petercooperjr](#): > > I don't currently use wildcard certs, so I have an `issuewild ";"` in my domain name, "just in case". Assuming you also have a valid `issue` property set up in your CAA record(s), having such an "empty" `issuewild` property would only prevent the CAs you actually _did_ allow issuance for to issue a wildcard certificate. I'm not really seeing the added benefit of that. Of course it would restrict an attacker to only issue non-wildcard certificates, but if they can already do such a thing, that would be Very Bad anyway.. Restricting the attacker to non-wildcard certificates only has almost no extra benefit IMO. ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [September 1, 2021, 8:56pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018/7 "2021-09-01T20:56:58Z")
Sorry, I suppose I wasn't clear: The CAA record I have for my domain has "issue" records for the couple CAs I use (Let's Encrypt and AWS), as well as the `issuewild ";"`. It probably wouldn't hurt anything to leave the issuewild off, as you say, (as presumably any attacker that could get Let's Encrypt or AWS to issue a wildcard cert would already have control of my DNS and could just change the CAA record too), but I don't think it hurts anything to leave it in there anyway. The entire point of CAA, after all, is to try to mitigate cases where somehow a CA has gone through domain validation but the domain owner didn't actually intend for that CA to be validating their domain, which is a pretty rare scenario as it is. Most users wouldn't ever notice if they never used CAA, if all is going well. But if you're going to use it, I figure you might as well lock it down as much as you can. ---
**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\ **Post date:** [September 1, 2021, 8:58pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018/8 "2021-09-01T20:58:39Z")
> [@petercooperjr](#): > > I don't think it hurts anything to leave it in there anyway. That's also very true 🙂 Unless you actually _want_ a wildcard certificate 😉 ---
**Author:** ![petercooperjr](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/petercooperjr/32/84698_2.png) [@petercooperjr](https://community.letsencrypt.org/u/petercooperjr)\ **Post date:** [September 1, 2021, 9:03pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018/9 "2021-09-01T21:03:32Z")
Well, if I end up wanting a wildcard certificate for something, and yet forget that I disabled it in my CAA, presumably the error message that I subsequently get would remind me pretty quickly that I needed to update my record. No different than people realizing that they need to update it when they switch CAs. ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [October 1, 2021, 9:03pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018/10 "2021-10-01T21:03:38Z")
Closed on October 1, 2021, 9:03pm UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.