CAA of the Wild: Supporting a New Standard
Dec 7, 2017Max Nystrom
Summary
This post details Cloudflare's adoption and rollout of the Certification Authority Authorization (CAA) Resource Record standard. It explains the purpose of CAA records in enhancing SSL certificate issuance security by allowing domain owners to specify authorized Certificate Authorities (CAs). The post highlights Cloudflare's beta program for testing CAA support, its eventual removal of the beta flag for all users, and its integration with Universal SSL. It also delves into the complexities and potential issues with the CAA record processing algorithm, particularly concerning CNAME records and wildcard domains, demonstrating Cloudflare's proactive approach to supporting and refining new internet security standards.
More from the Website Security & Threat Management trail
- We tested our own WAF with frontier AI models. Here’s what we found
- When scanners miss the attack: how Cloudflare Client-Side Security protects storefronts
- Introducing automatic remediation policies with Cloudflare CASB
- Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak Models
- Introducing Adaptive Intelligence: undermining the economics of every bot attack