CAA Drift vs Issued Certificates

What This Check Does

This check compares the certificates that have actually been issued for your domain against the Certificate Authority Authorization policy your domain currently publishes. If a certificate was issued by a CA your CAA records do not authorize, that inconsistency gets flagged.

CAA records are the mechanism domains use to declare which certificate authorities are permitted to issue certificates for them. They are a hard restriction that participating CAs are required to respect before issuing.

What CAA Drift Is

CAA drift is the gap between what your CAA policy says today and what has actually been issued against your domain. This gap can appear for a few different reasons. Your CAA policy may have been tightened after certificates were already issued under a more permissive configuration. The policy may have been set up after a cert was already in circulation. Or, in more serious cases, a certificate was issued by an authority that should not have been able to issue it at all given your current policy.

The records themselves do not tell you which of these happened. That is why the timing of the issuance matters.

Why This Is a Security Problem

CAA records exist specifically to limit your exposure to misissued certificates. A certificate issued by an unauthorized CA can be used to run a convincing man-in-the-middle attack, intercept HTTPS traffic, or impersonate your domain in ways that most users and systems will not detect, because the certificate will appear valid.

A recently issued certificate from an unauthorized CA is a serious signal. It may indicate that someone was able to trigger an issuance they should not have been able to trigger, either by exploiting a CA validation process, by briefly manipulating DNS to pass a domain control validation challenge, or by finding a CA that was not checking CAA at the time.

Certificate Transparency logs make this visible in hindsight. Every publicly trusted certificate is logged, and those logs are permanent and public. That means both you and attackers can see every certificate ever issued for your domain.

Severity Assessment

A certificate issued within the last 30 days by a CA your current CAA policy does not authorize is a critical finding. The cert is active, it may be in use, and the issuance is recent enough that it warrants immediate investigation. Certificates older than 30 days get a warning. They may reflect a policy that was later corrected, but they still represent a gap worth understanding and closing.

How to Fix It

Start by checking what your current CAA records actually say:

dig CAA yourdomain.com

If the domain has no CAA records, any CA can issue for it. That alone is worth fixing regardless of what the certificates in CT logs show.

For each flagged certificate, find out who issued it and when. If the issuance predates your CAA policy, the drift is historical and the priority is making sure the cert is expired or revoked and that the policy is now correct. If the issuance is recent and the CA is not one you have a relationship with, treat it as a potential incident and investigate how the certificate was obtained.

To close the gap going forward, make sure your CAA records accurately reflect every CA you actively use, and nothing more. A minimal CAA record looks like this:

yourdomain.com.    IN    CAA    0 issue "letsencrypt.org"

If you use more than one CA, add a separate issue entry for each one. Do not leave the record blank or use a wildcard allowance unless you have a specific reason to.

Also check parent zones. If sub.yourdomain.com has no CAA records of its own, most CAs will fall back to checking yourdomain.com. A policy gap at the subdomain level can expose subdomains even when the root is locked down.