Security finding
The CAA record does not allow the issuer of the certificate in use
Security Warning Severity: Medium
Part of the audit DNS points at things that are gone or unlisted. Finding id: security.caaVsCertificateIssuer.
What it costs you
The issuer has to refuse the next certificate for [host]. If renewal is automatic, it fails without anyone watching and the certificate runs out.
What to do
Add the issuer to the CAA records, or move the host to an issuer the records allow, before the certificate expires.
What it checks
- Certificate rules forbid current issuer
How to fix it
Make the CAA records and the issuer agree
- Decide which certificate authority should issue for [host].
- To keep [issuer]: add a CAA record with the issue property and the domain name that authority documents for CAA, at [caa host].
- To keep the records: order the next certificate for [host] from an authority they name, before the current one expires.
How to check: dig +short CAA [caa host]
How to verify by hand
The DNS and mail provider consoles.
What this relies on
Records outlive the services they were created for.