Restrict authorized certificate authorities without breaking automated renewals.
Before you start
Work on a copy or a controlled test when the change can affect production. Keep timestamps, screenshots and the previous configuration so the result can be compared.
Step by step
- List the certificate authorities actually used for the domain.
- Add suitable CAA issue and, when needed, issuewild records.
- Publish on the zone apex first and check inheritance on subdomains.
- Query CAA records through multiple resolvers and verify the TTL.
- Run a renewal test before making the policy more restrictive.
Validation
Repeat the original test after the change and confirm that the expected service works without creating a new regression. Document the final state.