What CAA records should use for Let's Encrypt?

[JuergenAuer]

@9peppe

not really, CAA checks parent domains: a CAA record on example.com applies to its subdomains.

He must.

@ravecat

0 issue “;”
0 issuewild “letsencrypt.org”

allows only *.example.com, not example.com. But a certificate with *.example.com doesn't work with example.com.

The Tree climbing is another problem.