All fixes

Add CAA records to your DNS

dns-caa · Updated

Without CAA records any certificate authority may issue for your domain. CAA names the ones you use, so a mis-issued certificate is refused.

Why this matters

Without CAA records, any certificate authority can issue an SSL certificate for your site. CAA records let you specify who's allowed to. It's an extra safety net.

Cloudflare

  1. 1 Go to DNS > Records
  2. 2 Add CAA records to restrict which CAs can issue certificates
Type: CAA
Name: @
Tag: issue
Value: "letsencrypt.org"

# Add more for other CAs you use:
# Tag: issue, Value: "digicert.com"

Related fixes

Does your app still have this?

Scan your domain