CAA Record Generator
Build CAA records that tell certificate authorities which of them may issue certificates for your domain — including wildcard rules and an address for violation reports.
Allowed CAs
Wildcard certificates
| Name / host | Type | Value |
|---|---|---|
@ | CAA | 0 issue "letsencrypt.org" |
@ | CAA | 0 issue "sectigo.com" |
@ | CAA | 0 issue "zerossl.com" |
@ IN CAA 0 issue "letsencrypt.org"
@ IN CAA 0 issue "sectigo.com"
@ IN CAA 0 issue "zerossl.com"How it works
How CAA works
Checked before every issuance
Every public CA must look up CAA records before issuing. If your domain lists other CAs, they must refuse.
Inherited by subdomains
A CAA record on example.com also applies to www.example.com and every other subdomain without their own CAA records.
FAQ
Frequently asked questions
Will CAA break my existing certificates?
No. CAA is only checked when a certificate is issued or renewed. Make sure every CA you use, including your CDN's, is listed before renewals.
Which CAs does Yeap Cloud use?
Free certificates come from Let's Encrypt or ZeroSSL; paid certificates are issued by the CA of the product you buy. Add every CA you use to the record.
More free tools
All toolsSSL CheckerCheck a site's certificate, chain, expiry and TLS versions.Security Headers CheckerGrade a site's HTTP security headers from A+ to F.SSL ToolsGenerate CSRs, decode certificates, build chains, match keys.CSR GeneratorCreate a certificate signing request and private key.Certificate DecoderDecode a PEM certificate: names, issuer, validity, key.SSL Chain BuilderFetch missing intermediates and build a full certificate chain.Certificate Key MatcherCheck that a certificate and a private key belong together.DNS LookupQuery A, AAAA, MX, TXT, NS, CAA and more from public resolvers.
SSL certificates from trusted CAs
SSL Certificates DV, OV and EV from trusted CAs