CAA generator

Control which certificate authorities may issue certificates for your domain: pick your CAs, set the rules, copy the CAA records.

Control which certificate authorities (CAs) may issue certificates for your domain. The records update live.

Allow no CA (forbid issuance entirely)

Creates issue ";". No CA can issue certificates afterwards, not even renewals.

Allowed certificate authorities

Let's Encryptletsencrypt.orgSectigo / ZeroSSLsectigo.comDigiCertdigicert.comGlobalSignglobalsign.comGoogle Trust Servicespki.googBuypassbuypass.comSSL.comssl.comAmazon (AWS)amazon.com

Additional CA domains

Separate multiple values with commas

Wildcard certificates (issuewild)

Without an issuewild entry the issue rules also apply to wildcards.

Report address for violations (iodef, optional)

CAs can report requests that violate your CAA rules to this address.

Set the critical flag (flags 128)

Only needed if CAs must never ignore the record; the default is 0.

Your CAA records

Host / name@ (domain root)TypeCAA

Values (1 record)

0 issue "letsencrypt.org"

At regfish the assistant creates this record for you in one click: sign up for free →

A service by regfish GmbH ↗All tools API Imprint Privacy