[DNS] CAA – Certification Authority Authorization 指南

Intro

DNS CAA (DNS憑證頒發機構授權) – Wikipedia

RFC 6844

通過域名持有人指定其域名的白名單憑證頒發機構來實現的安全機制。
該政策透過一個新的域名系統資源記錄(Record)「CAA」來實現,Record範例如下:

example.com. CAA 0 issue "ca.example.net"

設定

首先 DNS records 要能夠支援 CAA record

再來針對憑證機構產生及設定 CAA record 即可,以下範例以 Letss Encrypt 機構為例:

example.com. CAA 0 issue "letsencrypt.org"

CAA Record Helper – CAA資源記錄產生器


References

淺談 DNS Certification Authority Authorization (CAA) – BEPSVPT

CAA Record and why it is needed (SSL related) – Namecheap

Leave a Reply

Your email address will not be published. Required fields are marked *