# CAA "issuewild" question

**URL:** <https://community.letsencrypt.org/t/caa-issuewild-question/159018>\
**Category:** Issuance Policy\
**Created:** [September 1, 2021, 7:17pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018 "2021-09-01T19:17:08Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![Osiris](https://avatars.discourse-cdn.com/v4/letter/o/839c29/32.png) [@Osiris](https://community.letsencrypt.org/u/Osiris)\
**Post date:** [September 1, 2021, 7:42pm UTC](https://community.letsencrypt.org/t/caa-issuewild-question/159018/4 "2021-09-01T19:42:11Z")

</div>

> [@rg305](#):
>
> OK, so then is this how LE implements the RFC (8659)?

You can see the issue/issuewild logic here:

> <https://github.com/letsencrypt/boulder/blob/4967f0f93287ade920957083e1540deb4ea93386/va/caa.go#L234-L242>

It uses the `issue` set of properties of a CAA record by default _unless_ the certificate is a wildcard certificate **and** there is one or more `issuewild` properties in the CAA record present. If not, it just uses the default of `issue` properties.

> [@rg305](#):
>
> Are other CAs able to implement it in any other way?

I'm pretty sure that would violate the BR. Article 3.2.2.8 of the current BR (1.8.0) only specifies that the CA needs to adhere to RFC 8659.

> [@rg305](#):
>
> [should I update my CAA records to include "issuewild" constraints?]

Depends what you want to achieve with that?

> [@rg305](#):
>
> You didn't explicitly say that I could... so I won't.  
> OR  
> You didn't explicitly say that I couldn't... so I will.

Those are the exact two options you've listed in your OP whereas there is a third option: "If no issuewild property has been set, the CA needs to abide to the issue property/properties for wildcard certificates".

---

_[View the full topic](https://community.letsencrypt.org/t/caa-issuewild-question/159018)._