|
|
|
|
|
|
by g_p
940 days ago
|
|
|
No, and the standard (RFC 6844) says they must not. That's because, in the eyes of the standard, a CAA record is applicable at time of issuance, but a valid certificate could have been previously issued (and still be valid), even though you've moved to a new CAA record for your next certificate. "Relying Applications MUST NOT use CAA records as part of certificate validation." For what you're looking for, DANE (RFC 6698) would be more useful and enable the browser to check the presented certificate against DNS (so effectively CAA on the client). |
|
|