Bulletproof TLS Newsletter 
Bulletproof TLS Newsletter is a free periodic newsletter bringing you commentary and news surrounding SSL/TLS and Internet PKI, designed to keep you informed about the latest developments in this space. Received monthly by more than 50,000 subscribers. Written by Ivan Ristić.
Current Issue
CAA Expands into New Use Cases
28 Feb 2023
Certification Authority Authorization (CAA) is a good example of a technology that’s slow and steady. Originally conceived in 2013 as RFC 6844, it was adopted by the CA/Browser Forum and mandated for all CAs in 2017, and eventually brought to its current shape in 2019 as RFC 8659. Although not perfect, it gets the job done, and support for it continues to grow.
If you’re not already familiar with CAA, in essence it’s a mechanism that enables domain owners to advertise a certificate issuance policy, in effect controlling which CAs are allowed to issue certificates for their properties. It builds on top of DNS and relies on a new resource record type.
The original form of CAA has been extended to satisfy two additional use cases. First, the CA/Browser Forum added the contactemail and contactphone extensions to enable policies to communicate contact information for those in charge of certificate issuance.
Subscribe to the Bulletproof TLS Newsletter
This subscription is just for the newsletter; we won't send you anything else.
Recent Issues
Designed by Ivan Ristić, the author of SSL Labs, Bulletproof TLS and PKI, and Hardenize, our course covers everything you need to know to deploy secure servers and encrypted web applications.
Remote and trainer-led, with small classes and a choice of timezones.
Join over 1,500 students who have benefited from more than a decade of deep TLS and PKI expertise.