SSL Certificate Tools - CAA Record Generator

SSL Certificte Spacial Price Discount 5% - 75% from Vendor Direct Pricing, Order Now get Extra Discount 5% - 10%

FREE tools available to our customers and everyone to help with common SSL issues.

Updated 20/09/2024 - Introducing new services SSL Live Search, search by keywords and SSL Wizard a guide to choosing the right SSL Certificate

Home/Index
What is a HTTPS
Moving HTTP to HTTPS
SSL Wizard
CSR & Private Key Gen.
Certificate Key Matcher

SSL Converter
SSL Installation
SSL Install Checker 1
SSL Install Checker 2
Secure Site Seal
CSR Decoder
SSL Decoder

Why No Padlock
Expiry Monitor
CAA Record Gen.
HTTP Header Check
Website CP Checker
Approver Email Checker

Server Checker (Deep Analysis)
Check SSL/TLS Capabilities of Your Browser
SSL Live Search
Buy SSL Certificate
Domain Validation

Over a hundred certificate authorities (CAs) have the power to issue certificates which vouch for the identity of your website. Certificate Authority Authorization (CAA) is a way for you to whitelist the CAs you actually use so you can minimize your risk from security vulnerabilities in all the others.

Beginning September 8, 2017, all certificate authorities will be required to respect your CAA policy, so now is the perfect time to set up CAA. Setting up CAA using this tool is an easy way to improve your website's security. Learn More

1. Enter Your Domain Name

Domain name:

2. Select Authorized Certificate Authorities

Check off the certificate authorities which you authorize to issue certificates for your domain. You can separately authorize the issuance of wildcard and non-wildcard certificates.

Filter by CA name:

	Type of certificate
	Non-Wildcard	Wildcard
Amazon
ComodoPositiveSSL
Entrust
GlobalSignAlphaSSL
GoDaddyStarfield Technologies
Google Trust Services
Let's Encrypt
SwissSign
SymantecGeoTrust, Thawte, RapidSSL

3. Incident Reporting (Optional)

You can specify an email address or URL for reporting certificate requests or issued certificates that violate your CAA policy. Reports will be provided in iodef format.

Email address or URL:

4. Publish Your CAA Policy

Add the following CAA records to your domain's DNS. Your DNS must be hosted with a service that supports CAA.

Generic

For Google Cloud DNS, Route 53, DNSimple, and other hosted DNS services

Name	Type	Value

Standard Zone File

For BIND ≥9.9.6, PowerDNS ≥4.0.0, NSD ≥4.0.1, Knot DNS ≥2.2.0

Legacy Zone File (RFC 3597 Syntax)

For BIND <9.9.6, NSD <4.0.1, Windows Server 2016

tinydns

5. Monitor Your Domain (Optional)

Even if you publish a CAA record, a noncompliant certificate authority can ignore your CAA records. Use Cert Spotter to monitor Certificate Transparency logs so you'll get an email if this happens.