Certification Authority Authorization (CAA) is a DNS-based policy that tells certificate authorities which organizations may issue TLS certificates for a domain. It reduces unauthorized certificate issuance by binding domain control to explicit issuing permissions, supporting stronger certificate governance and limiting fraud, misissuance, and trust abuse across internet-facing services.
What CAA Changes in Certificate Issuance
CAA moves certificate issuance from an implicit trust assumption to an explicit policy check. It tells certificate authorities which issuers are permitted to issue TLS certificates for a domain, so a CA must see the right authorization before it can proceed.
That matters because public certificate issuance is not just a technical formality, it is part of the trust chain for web services, APIs, and other internet-facing systems. When issuance is constrained at the DNS level, domain owners gain a direct control point over who can mint certificates in their name.
How CAA Supports Certificate Governance
CAA is best understood as a governance control for the domain-to-certificate relationship. It lets an organisation express policy at the domain boundary, rather than relying only on downstream CA process checks or incident response after a bad certificate appears.
The practical value is clarity and restraint. If a domain should only receive certificates from a limited set of issuers, CAA helps encode that rule in a machine-readable way, reducing ambiguity across external certificate workflows and delegated service arrangements.
Why CAA Is Important for Trust and Misissuance Control
Unauthorized certificate issuance is dangerous because a valid-looking certificate can be used to impersonate a service, intercept traffic, or create a false sense of trust in a domain. CAA does not replace CA security, but it narrows the conditions under which misissuance can happen.
That makes it especially relevant for environments with multiple teams, outsourced hosting, or frequent platform changes. A well-formed CAA policy helps prevent accidental issuance from the wrong CA and reduces the blast radius of certificate abuse when domain control is shared across business units or vendors.
Operational Use of CAA in a Certificate Program
CAA should be treated as one layer in a broader certificate management process, not as a standalone safeguard. It works best when the domain inventory, certificate ownership, and approved issuer list are kept current as services move, vendors change, or new platforms are introduced.
For organisations that already manage TLS at scale, CAA is a lightweight policy signal that can reinforce approval workflows and support certificate hygiene. It is most effective when paired with monitoring for unexpected issuance, periodic review of DNS policy records, and a clear process for updating issuer permissions before planned certificate changes.
Risk and Threat Considerations
CAA mainly reduces the risk of certificate misissuance, but it is only as strong as the accuracy and coverage of the DNS policy it depends on. If the record is missing, outdated, or too permissive, the domain can still be exposed to unauthorized certificate issuance and the trust abuse that follows.
Failure mechanism: An attacker, misconfigured workflow, or overly broad issuer policy can result in a certificate being issued by a CA that should not have been allowed to sign for the domain.
Impact: The resulting certificate can support phishing, man-in-the-middle interception, brand impersonation, or other forms of TLS trust abuse that are difficult to distinguish from legitimate service traffic.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5, NIST CSF 2.0 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | SC-12 — Cryptographic Key Establishment and Management | CAA governs which authorities may issue TLS certificates for a domain. |
| SC-17 — Public Key Infrastructure Certificates | CAA directly affects certificate issuance governance for public TLS certificates. | |
| Recommendation — Restrict approved certificate issuers and review issuance policy as part of cryptographic trust governance. Use certificate policy controls to limit which CAs can issue certificates for protected domains. | ||
| ISO/IEC 27001:2022 | A.8.24 — Use of cryptography | CAA supports controlled use of TLS certificates and certificate trust relationships. |
| Recommendation — Define and enforce rules for certificate issuance and trust as part of cryptographic governance. | ||
| NIST CSF 2.0 | PR.DS-04 — Data-in-Transit is Protected | CAA strengthens trust in TLS by reducing unauthorized certificate issuance. |
| Recommendation — Protect in-transit communications by governing which issuers can mint domain certificates. | ||
| CIS Controls v8 | 5 — Account Management | CAA complements governance over trusted issuance paths and external certificate dependency control. |
| Recommendation — Maintain authoritative control over certificate issuance permissions and review them regularly. | ||
Practitioner Guidance
Why practitioners should care: CAA is most useful when certificate issuance is frequent, distributed, or delegated across teams and providers. In those environments, it provides a simple policy boundary that helps prevent certificate sprawl from becoming a trust problem.
What to watch for: Keep issuer permissions aligned with the real service landscape, especially after migrations, acquisitions, or vendor changes. A stale CAA policy can block legitimate issuance or, if left too broad, fail to prevent unwanted issuance.
Practitioner takeaway: Treat CAA as a governance control that should be reviewed alongside certificate ownership, DNS management, and issuer approval processes, not as a set-and-forget record.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org