Enable missing SSL CAA record

The domains DNS zone does not specify any Certification Authority Authorization (CAA) record. This means that all certificate authorities (CAs) are allowed to issue certificates for this domain.

Security Assessment

Security_Assessment_ EnablemissingSSLCAArecord

CVSS Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N

Vulnerability Information

The domains DNS zone does not specify any Certification Authority Authorization (CAA) record. This means that all certificate authorities (CAs) are allowed to issue certificates for this domain. To decrease the risk of rogue certificates, append the CAA settings to the DNS records.

Guides

To enable CAA, you need to specify the appropriate record in your DNS server. For example the following records allows only Let's Encrypt to issue certificates for your domain example.org.

missingsslcaa

https://github.com/crashtest-security/gist/blob/master/ssl_tls_vulnerabilities/missing_ssl_caa

A free online tool can help you to generate the correct CAA record: https://sslmate.com/caa/

If you do not have direct access to your DNS server, you need to ask your DNS provider to set this entry for you. Creating the record can be normally done in their configuration interface.

dnsimple

With dnsimple, you can add the CAA record in the web interface. Use the Record editor and add your CA as the provider for your certificate. Further information is found on their website.

For more information about Crashtest Security visit crashtest-security.com