Hacker News Reader

I've been doing development and devops for years and have never heard of a CAA. Then again, I use http-01 and not dns validation, so that's probably why. Before LetsEncrypt I'd buy certs and it involved a lot of copying/pasting CSRs into web interfaces.

View on HN

To be clear, CAA is relevant even if you're using http-01. CAs need to check whether the CAA records of a given domain allow/forbid issuance in addition to any of the methods used to demonstrate domain ownership to the CA.

Reply on news.ycombinator.com