Hi, I'm trying to understand the CAA issuance policy when it comes to CNAMES. I have the following situation: jeaton.org. 3600 IN CAA 0 issue "sectigo.com" foo.jeaton.org. 3600 IN CNAME bar.jeaton.com. bar.jeaton.com. 231 IN CNAME prod-cf-alb-XXXX.u…

[image] jeaton3: Right now, as I understand it, letsencrypt will attempt CAA verification. Because they are CNAME records, those are followed and the CAA for prod-cf-alb-XXXX.us-east-1.elb.amazonaws.com is requested. There is no CAA record there, so it walks up the original hostname tree, from f…

ACME specifics aside, ultimately CNAME records are just delegations. You as the zone owner are giving control over that particular FQDN to a 3rd party for all record types which includes CAA records. You don't get to decide what sort of cert the vendor will get when you point your records to their …

That's entirely the problem. The vendor wants to get a letsencrypt.org cert. I want to allow them to do so specifically for this hostname. Given the use of CNAMEs, I can't set one to exempt it from my top-level domain policy. Because the vendor runs on top of AWS and uses CNAMES pointing to AWS …

If the vendor is running their infrastructure on AWS, why are they trying to get a Let's Encrypt cert instead of an AWS ACM cert which is also free and easily integrates (including automatic renewals) with AWS services such as ALB/NLB? In any case, it shouldn't be your problem. It's the vendor's pr…

[image] jeaton3: at the top level of jeaton.org ? I can't do the former, and I don't want to do the latter. Have you considered adding a CAA record at your top level that allows only your vendor's ACME account to use LE for your domain? Like shown at these examples: Certificate Authority Aut…

If I had a nickel for every time I've asked "why doesn't the vendor..." It may not be my fault, but it is my problem. :frowning: Thanks all for your help. I have to fight my way through vendor support to talk to someone who can actually tell me what they can do, since I can't really do anything …

If they can tell you why they think they need a Let's Encrypt cert specifically, we might be able to provide guidance. My gut says they're trying to get an LE cert for the origin/backend boxes sitting behind the AWS ALB which is totally unnecessary. Last I checked, ALB does zero cert validation betw…

[image] jeaton3: opening up the entire domain to allowing the entire domain to get letsencrypt Why is that a problem? If you need multiple accounts to be able to issue LE certificates, you could limit it to methods, like " letsencrypt.org ;validationmethods=dns-01" This will prevent for exampl…

[image] sebastiannielsen: For what I know, lets encrypt won't parse multiple CAA with " letsencrypt.org ;accounturi" and will stop at the first one. Boulder (the ACME server implementation used by Let's Encrypt) will check all CAA records for the relevant domain to test whether any of them auth…

ooh then its no problem for the OP. Then he can make multiple letsencrypt records with different accounturi parameters. I tought the parsing logic was, "stop at the first CAA record that is "yours" and then read the parameters". but in this case its simple for the OP to just authorize the accountu…

CNAME and CAA clarification

Issuance Policy

AtmosphericIgnition April 17, 2026, 2:05am 12

I asked a very similar question a couple of weeks ago, maybe this thread will help you how CNAME records work.

Topic		Replies	Views
CAA 403 issue, with multiple CNAME configuration Help	12	2144	August 21, 2019
CAA & CNAME along with external service Help	9	2432	April 20, 2021
Approve Let's Encrypt certs Feature Requests	11	1358	April 29, 2023
Will it be sufficient if we update valid CAA on the cname domain to issue certificate? Help	7	686	September 4, 2020
Subdomain CNAME being ignored when validating CAA Help	11	867	May 10, 2024

CNAME and CAA clarification

Related topics