Gulf CybersecurityBaseline
العربيةCheck your domain
Kuwait City at night from space, its streets in amber light along the dark water of the bayRiyadh at night from space, a wide grid of white and amber light in the desertDubai at night from space, with Palm Jumeirah lit in the sea below the coast roadDoha at night from space, the city's lights spreading from the bay along its roadsBahrain at night from space, the island's towns joined by lit roads in a dark seaMuscat and Al Seeb at night from space, the coast road and the airport in amber light beside a dark sea

CAA published

Allowed certificate issuers (CAA)

Does the domain name the certificate authorities allowed to issue for it?

Why it matters

Certificate authorities must check CAA before they issue. A CAA record that names your chosen authorities stops every other authority from issuing a certificate for the domain, which narrows the paths to a fraudulent certificate.

When a domain passes

Passes when a CAA record applies to the domain, either its own or one inherited from a parent name.

How to fix it

  1. List the authorities that issue your certificates today.
  2. Publish CAA records with an issue entry for each of them and an address for incident reports.

An example record

example.com  CAA  0 issue "letsencrypt.org"
example.com  CAA  0 iodef "mailto:pki@example.com"

Reference specifications

All thirteen standards