Discuss your project

TOOLBOX · GENERATOR

CreateCAA Records.

Select certificate authorities, control wildcards and copy the finished records for your DNS provider’s form or as a zone file. Runs only in your browser.

Examples

An example fills the form with suitable values. Your domain is kept; if it is empty, example.at is used.

Domain

Also applies to all subdomains without their own CAA record.

Certificates for This Domain
Permitted Certificate Authorities

The SSL/TLS check or your browser’s certificate details show which authority issues your current certificates.

The domain the certificate authority specifies for CAA, one per line.

Select at least one certificate authority. If none should be allowed to issue, choose that option above.

Wildcard Certificates
Wildcards (*.domain)
Reporting Address and Account (Optional)

An email address or https:// URL.

Your CAA Records

Enter your domain above or select an example. The records are generated here as you choose.

Browser only: this tool does not send your input to TOMORIS or third parties and does not store it.

STEP BY STEP

Review First.
Then Define.

CAA records are stored in your domain’s DNS. A record that omits an authority you use blocks its next issuance. First take stock of your certificates.

  1. 01

    Take Stock

    For your website, mail server, VPN and all subdomains, check who issues the certificates: in your browser or with the SSL/TLS Check (German).

  2. 02

    Include Your Services

    CDNs, hosting and website builders often request certificates themselves. Ask which authorities they use.

  3. 03

    Generate Records

    Select every authority you use, block wildcards if appropriate and add a reporting address.

  4. 04

    Publish with Time to Spare

    Do not wait until just before renewal: after checking, certificate authorities may continue issuing until the record’s TTL expires, for at least 8 hours (Baseline Requirements, 4.2.2.1).

  5. 05

    Check

    The DNS Security Check (German) shows which authorities may issue afterwards.

COMMON MISTAKES

Where CAA
Often Goes Wrong.

  • Forgetting the Service That Obtains Certificates

    Cloudflare issues Universal SSL certificates through Let's Encrypt, Google Trust Services and SSL.com, and adds the necessary CAA records itself when you create your own (Cloudflare). Free Azure App Service certificates come from DigiCert (Microsoft Learn).

  • Wrong Identifier

    letsencrypt.com instead of letsencrypt.org, or a product name instead of its identifier: ZeroSSL uses sectigo.com, for example.

  • Flag 128

    With 128 (“critical”), an authority that does not recognize the property may not issue at all (RFC 8659, Section 4.5). For issue, issuewild and iodef, 0 is sufficient.

  • Only issuewild

    issuewild alone restricts only wildcard certificates. Any authority may still issue regular certificates.

  • Record at the Wrong Subdomain

    If a subdomain has its own CAA records, only those apply, rather than the records of the domain above it.

  • Treating iodef as Protection

    The reporting address is an option for authorities, rather than a reporting obligation. Protection comes from issue and issuewild.

SOURCES AND NEXT STEPS

Based on Standards
and Industry Rules.

QUESTIONS

Good to Know.

What does a CAA record do?

It defines which certificate authorities may issue certificates for your domain. Public certificate authorities must check it before each issuance and follow it under RFC 8659 (CA/Browser Forum Baseline Requirements, Section 4.2.2.1). Someone trying to obtain an unauthorized certificate for your domain must then deceive one of the listed authorities.

Will my existing certificates become invalid?

No. CAA matters only at issuance; browsers do not check the record (RFC 8659, Section 1). Issued certificates remain valid until they expire. However, the next renewal at an authority that is not listed will fail.

Does the record also apply to subdomains?

Yes. Certificate authorities search upwards from the requested name to the first CAA record (RFC 8659, Section 3). A record at example.at also applies to shop.example.at unless it has its own record.

What is my certificate authority’s identifier?

The domain the authority specifies for CAA in its documentation, such as letsencrypt.org or digicert.com. The Common CA Database (CCADB) maintained by major browser and operating system vendors lists all identifiers. The SSL/TLS check shows which authority issues your current certificates.

What is issuewild for?

issuewild applies only to wildcard certificates (*.example.at) and takes precedence over issue for them (RFC 8659, Section 4.3). With issuewild ";", you block wildcards without restricting regular certificates.

Is my input transmitted?

No. The generator runs entirely in your browser. The domain and your choices are neither sent nor stored.

TOOLBOX

More
Tools.

YOUR NEXT STEP

You Have the Result.
What Comes Next?

We assess findings, prioritize by risk and put changes into practice on request: as a project with EXPERTS or as ongoing operations with GRID.

Discuss the Result