Title
Missing DNS CAA Record Allows Any Trusted Certificate Authority to Issue TLS Certificates
Summary
During the security assessment, it was identified that the domain does not have a Certification Authority Authorization (CAA) DNS record configured.
CAA records allow domain owners to explicitly specify which Certificate Authorities (CAs) are authorized to issue TLS/SSL certificates for their domain. In the absence of a CAA policy, any publicly trusted CA may issue a certificate after completing domain validation, increasing the risk of unauthorized or misissued certificates.
Although this is considered a defense-in-depth issue and does not directly result in exploitation, implementing CAA records is a security best practice recommended by industry standards.
Technical Description
The Certification Authority Authorization (CAA) DNS record (RFC 8659) enables domain owners to restrict certificate issuance to designated Certificate Authorities.
During testing, no CAA record was found for the target domain.
Target:
https:
Verification indicated:
✘ Couldn't find a CAA record
Domain not found
Without a CAA record:
Any publicly trusted Certificate Authority can issue a certificate for the domain after domain validation.
Unauthorized or accidental certificate issuance becomes more difficult to control.
Certificate Transparency logs remain the primary method for detecting unexpected certificate issuance instead of preventing it.
Steps to Reproduce
Navigate to the CAA validation tool:
https:
Enter the target domain:
www.amplenote.com
Run the DNS CAA lookup.
Observe that no CAA record is returned.
Working Proof of Concept (PoC)
Verification Result
Target:
www.amplenote.com
Result:
✘ Couldn't find a CAA record
Domain not found
DNS Lookup
Execute the following command:
dig CAA www.amplenote.com
or
nslookup -type=CAA www.amplenote.com
Expected Output:
;; ANSWER SECTION
(No CAA records returned)
This confirms that no CAA policy is configured for the domain.
Demonstration of Exploitation
Scenario 1 – Unauthorized Certificate Issuance
An attacker gains temporary control of DNS validation or exploits a weakness in domain validation.
Since no CAA policy exists, any trusted Certificate Authority may issue a certificate after successful validation.
The attacker obtains a valid TLS certificate for the target domain.
The certificate could then be used in phishing or man-in-the-middle attack scenarios if other security controls are also bypassed.
Note: A missing CAA record alone does not allow certificate issuance. An attacker would still need to satisfy the Certificate Authority's domain validation requirements.
Attack Scenario
The organization has not configured CAA records.
A Certificate Authority receives a request to issue a certificate.
Because no CAA restrictions exist, the CA is not limited to an approved issuer.
If domain validation is successfully completed (legitimately or through compromise), a certificate may be issued.
Unauthorized certificate issuance may increase the risk of impersonation or phishing.
User Impact
If combined with a compromise of domain validation, users may be exposed to:
Increased risk of phishing using valid TLS certificates.
Potential impersonation of the legitimate website.
Reduced assurance that certificates are issued only by trusted, organization-approved Certificate Authorities.
Business Impact
Increased risk of unauthorized certificate issuance.
Reduced control over certificate lifecycle management.
Increased exposure to certificate misissuance.
Reduced compliance with DNS security best practices.
Potential reputational damage if unauthorized certificates are issued.
Increased effort required to monitor Certificate Transparency logs.
Remediation
Configure CAA DNS records to explicitly authorize approved Certificate Authorities.
Example:
amplenote.com. 3600 IN CAA 0 issue "letsencrypt.org"
amplenote.com. 3600 IN CAA 0 issuewild "letsencrypt.org"
amplenote.com. 3600 IN CAA 0 iodef "mailto:security@amplenote.com"
If another CA is used (e.g., DigiCert, Sectigo, Google Trust Services), replace the issue value with the appropriate CA domain.
Additional recommendations:
Configure CAA records for both the root domain and relevant subdomains.
Monitor Certificate Transparency logs for unexpected certificate issuance.
Periodically audit DNS security configurations.
Review and update CAA records whenever changing Certificate Authorities.
References
RFC 8659 – DNS Certification Authority Authorization (CAA)
CA/Browser Forum Baseline Requirements
CAA Verification Tool: https: