CAA constrains which authority may issue. Two extension parameters narrow it further — to a specific account and a specific validation method — and both are capable of locking out your own renewal if published carelessly.
The two parameters
| Parameter | Constrains | Example |
|---|---|---|
accounturi | Which ACME account at that CA may issue | accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/123456 |
validationmethods | Which challenge types are acceptable | validationmethods=dns-01 |
example.com. CAA 0 issue "letsencrypt.org; \
accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/123456; \
validationmethods=dns-01"Read as English: Let’s Encrypt may issue for this name, only for account 123456, and only after a DNS-01 challenge. Anyone who gains control of a web server for this name still cannot obtain a certificate, because HTTP-01 is not permitted.
What each buys
accounturidefeats an attacker with a different account. Naming the CA alone means anyone who can pass a challenge at that CA can issue; naming the account means it must be yours.validationmethods=dns-01removes the web server from the trust path. Compromising the host that serves the site no longer yields a certificate for it, which is a meaningful narrowing for anything behind a CDN or a shared host.- Together they are close to pinning issuance to one client on one account using one method.
How this locks you out
accounturi pinned, then:
- the ACME client is reinstalled and registers a NEW account
- a second server has its own account
- the client rotates account keys
-> issuance refused. Renewal fails silently until expiry.
validationmethods=dns-01, then:
- the client falls back to HTTP-01 because the DNS API
credential expired
-> issuance refused. Same outcome.Both failures appear at renewal, which is weeks after the record was published and long after anyone connects the two. The certificate expires, and for a domain running MTA-STS or serving a BIMI file the consequences reach further than the website.
Pin the CA first, and live with it
0 issue "letsencrypt.org" alone is most of the benefit and has no lockout mode. Add accounturi only once you know every client and every server that renews for this name, and only with a monitored alert on certificate expiry — which you want regardless.
CAA and DNS-01 together
A DNS-01 challenge writes a _acme-challenge TXT record into the zone. On a signed zone that record must be signed and the zone re-serialised before the CA looks for it — so the signer has to re-sign and the change has to reach the secondaries. A zone that does not do this automatically fails validation with a record that is visibly present, which is one of the more confusing ways to lose an hour.