Controlling which authorities may issue certificates.
WHAT THEY DO
Specify which certificate authorities are permitted to issue certificates for your domain.
Authorities are required to check this before issuing.
WHY THEY EXIST
To prevent an unauthorised certificate being issued for your domain by an authority you do not use.
WHY THEY MATTER TO YOU
If a CAA record exists and does not permit the authority AutoSSL uses, certificate issuance fails.
That is an uncommon cause of AutoSSL failure and a genuinely puzzling one, because nothing else appears wrong.
CHECKING
A lookup for CAA records on your domain. Most domains have none, which permits any authority.
IF ONE EXISTS AND CERTIFICATES FAIL
Either add the authority we use, or remove the record.
Open a ticket and we will tell you which authority to permit.
WHETHER TO CREATE ONE
Not necessary for most sites. It is a hardening measure for organisations with specific requirements.
If you do create one, remember it and check it whenever certificate issuance fails.
THE PRACTICAL POINT
Worth knowing about, because when it causes a problem the cause is not obvious.
