CAA Account URI & ACME Method Validator
Inspect and build RFC 8657 CAA records. Pin your specific ACME Account URI and restrict authorized domain validation methods (dns-01 vs http-01) for hardened certificate defense.
🛠️ Hardened RFC 8657 CAA Policy Builder
Frequently Asked Questions
What is the security limitation of basic CAA issue records without RFC 8657?
A standard CAA record like issue "letsencrypt.org" authorizes Let's Encrypt to issue certificates, but does not distinguish between you and any of the 400+ million other Let's Encrypt subscribers. If an adversary compromises your web server or DNS temporarily, they can request certificates from the authorized CA using their own account.
How does the RFC 8657 accounturi parameter lock down certificate issuance?
The accounturi parameter restricts certificate issuance exclusively to your specific registered account URL at the Certificate Authority (e.g. accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/12345678). Even if an attacker passes domain control validation, the CA will refuse to issue the certificate unless the request originates from your exact account URI.
What is the validationmethods CAA parameter?
The validationmethods parameter specifies which ACME challenge validation types the CA is allowed to perform (e.g. dns-01, http-01, or tls-alpn-01). For instance, an enterprise can strictly enforce validationmethods=dns-01 to prevent rogue certificates obtained via hijacked HTTP web servers.
Which Certificate Authorities currently support RFC 8657 CAA extensions?
Let's Encrypt was the primary pioneer and fully enforces both accounturi and validationmethods. Commercial enterprise CAs including DigiCert, Sectigo, and Google Trust Services support account binding for automated ACME clients.