CAA Findings
A CAA (Certificate Authority Authorization) record in DNS names the certificate authorities allowed to issue certificates for a domain. CAs must check it before issuing, so a missing or wrong record can let any CA issue for you, or stop your own CA from renewing your certificate.
The CAA check only needs the DNS lookup, so it still runs when the connection to the service fails. It doesn't apply to a monitor whose hostname is an IP address.
The CAA Generator builds a correct record for the CA your server's certificate comes from. A typical record set looks like this:
example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 iodef "mailto:security@example.com"
To confirm any fix on this page, wait for the DNS change to be visible, then click Check Now on the monitor's page. dig CAA example.com shows the records the public DNS returns.
CERT_CAA01: No CAA record
Key: CERT_CAA01 · Label: CAA Not Found · Severity: Warning · Can be dismissed: Yes
What it means: the domain has no CAA record, so any certificate authority may issue certificates for it.
Why it matters: a CAA record is a cheap safeguard against a certificate being issued for your domain by a CA you don't use.
How to fix it: add a CAA record naming the CAs you use; the CAA Generator builds one. If you've decided not to publish CAA records, dismiss this finding on the monitor; a dismissed finding doesn't alert.
CERT_CAA02: CAA record only on a parent domain
Key: CERT_CAA02 · Label: CAA Not Specific · Severity: Notice (a suggestion) · Can be dismissed: Yes
What it means: only a parent domain has a CAA record (for example example.com for the monitor mail.example.com); this hostname has none of its own.
Why it matters: the parent's record applies, so this is valid. A record on the hostname itself makes its policy explicit and keeps it from changing when the parent's record does.
How to fix it: add a CAA record on this hostname; the CAA Generator builds one.
CERT_CAA03: CAA record doesn't allow this CA
Key: CERT_CAA03 · Label: CAA Record Failure · Severity: Error · Can be dismissed: No
What it means: the domain's CAA record doesn't allow the certificate authority that issued this certificate. We identify the CA from the certificate chain the server sends, and compare the record with the CAA identifier that CA publishes. A certificate from a private or internal CA isn't compared.
Why it matters: the certificate works today, but renewing it with the same CA will fail.
How to fix it: add the CA to the CAA record (the CAA Generator shows the record to add), or move to a CA the record allows.
CERT_CAA04: CAA record has an unknown critical tag
Key: CERT_CAA04 · Label: CAA Critical Tag · Severity: Warning · Can be dismissed: No
What it means: a CAA record has the critical flag (128) on a tag that certificate authorities don't recognize.
Why it matters: under RFC 8659 a CA must refuse to issue when it meets a critical tag it doesn't understand, so no CA can issue or renew for the domain.
How to fix it: remove the critical flag from that record (128 becomes 0), or remove the record.
CERT_CAA05: CAA lookup failed
Key: CERT_CAA05 · Label: CAA Lookup Failed · Severity: Warning · Can be dismissed: No
What it means: the CAA lookup failed: the domain's DNS servers returned an error (such as SERVFAIL) or didn't answer, so the record couldn't be checked.
Why it matters: certificate authorities refuse to issue when the CAA lookup fails, so a lasting failure blocks renewal.
How to fix it: check that the domain's DNS servers answer CAA queries, including for names that have no CAA record. Some older DNS servers and appliances answer an unknown record type with an error instead of an empty answer.
CERT_CAA06: CAA record forbids every CA
Key: CERT_CAA06 · Label: CAA Forbids All Issuers · Severity: Error · Can be dismissed: No
What it means: the domain's CAA issue (or issuewild) records are empty, such as 0 issue ";", which allows no certificate authority at all.
Why it matters: no certificate can be issued or renewed for the domain. That's the intent for a domain that should never have certificates, but not for one you're monitoring.
How to fix it: replace the empty issue record with one naming your CA; the CAA Generator builds one.
CERT_CAA07: CAA record is malformed
Key: CERT_CAA07 · Label: CAA Record Malformed · Severity: Error · Can be dismissed: No
What it means: an issue or issuewild record doesn't follow the RFC 8659 syntax, for example a trailing dot on the CA's domain, an invalid character, or a parameter without a value.
Why it matters: certificate authorities treat a malformed record as not allowing them, so renewal will fail.
How to fix it: correct the record's syntax; the CAA Generator builds a valid one.