diff --git a/content/en/docs/caa.md b/content/en/docs/caa.md index 595bac8c0..35c27bc5b 100644 --- a/content/en/docs/caa.md +++ b/content/en/docs/caa.md @@ -1,7 +1,7 @@ --- -title: Certificate Authority Authorization (CAA) +title: Certification Authority Authorization (CAA) slug: caa -lastmod: 2023-08-16 +lastmod: 2026-10-04 show_lastmod: 1 --- diff --git a/content/en/docs/glossary.md b/content/en/docs/glossary.md index 2855cc527..ed3b32cf5 100644 --- a/content/en/docs/glossary.md +++ b/content/en/docs/glossary.md @@ -1,7 +1,7 @@ --- title: Glossary slug: glossary -lastmod: 2026-09-08 +lastmod: 2026-10-04 show_lastmod: 1 description: "A glossary of terms related to SSL/TLS certificates, HTTPS, and web security used by Let's Encrypt." --- @@ -37,7 +37,7 @@ Note for translators: {{% def id="BRs" name="Baseline Requirements" abbr="BRs" %}} A set of technical and policy requirements for CAs. Since all major [root programs](#def-root-program) incorporate the Baseline Requirements, CAs must follow these requirements to be trusted by most browsers. {{% /def %}} -{{% def id="CAA" name="Certificate Authority Authorization" abbr="CAA" abbr_first="1" %}} A DNS record that specifies which [CAs](#def-CA) are allowed to issue certificates for the corresponding domain name. CAA records are checked by CAs, not by browsers. [Let's Encrypt](#def-LE) [honors CAA records](/docs/caa) as required by the [Baseline Requirements](#def-BRs). - [Wikipedia](https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization) {{% /def %}} +{{% def id="CAA" name="Certification Authority Authorization" abbr="CAA" abbr_first="1" %}} A DNS record that specifies which [CAs](#def-CA) are allowed to issue certificates for the corresponding domain name. CAA records are checked by CAs, not by browsers. [Let's Encrypt](#def-LE) [honors CAA records](/docs/caa) as required by the [Baseline Requirements](#def-BRs). - [Wikipedia](https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization) {{% /def %}} {{% def id="CNAME" name="Canonical Name record" abbr="CNAME" %}} A DNS entry which maps one domain name to another, referred to as the Canonical Name. [Wikipedia](https://en.wikipedia.org/wiki/CNAME_record) {{% /def %}} diff --git a/content/en/docs/profiles.md b/content/en/docs/profiles.md index 4746b6c12..cf0ba3514 100644 --- a/content/en/docs/profiles.md +++ b/content/en/docs/profiles.md @@ -1,7 +1,7 @@ --- title: Profiles slug: profiles -lastmod: 2026-09-08 +lastmod: 2026-10-04 show_lastmod: false --- @@ -43,7 +43,7 @@ The classic profile is the default profile selected for all orders which do not The tlsserver profile is a new profile which updates several of these validation and certificate properties in order to reflect the latest recommendations from the CA/Browser Forum Baseline Requirements, as well as general trends within the WebPKI community. We recommend selecting this profile for subscribers who want smaller certificates and who fully embrace automation. -The pending authorization lifetime has been reduced to further encourage automation: fully automated systems can complete a validation challenge within seconds, so a lifetime of just one hour is more than enough. The authorization reuse period has been reduced to seven hours. This is because the Baseline Requirements require that we re-check Certificate Authority Authorization (CAA) after eight hours, so limiting the reuse period means that we don't have to perform rechecks. The order lifetime has been reduced to the sum of two authorization lifetimes, because there is little purpose to having an order that outlives the authorizations it depends on. +The pending authorization lifetime has been reduced to further encourage automation: fully automated systems can complete a validation challenge within seconds, so a lifetime of just one hour is more than enough. The authorization reuse period has been reduced to seven hours. This is because the Baseline Requirements require that we re-check Certification Authority Authorization (CAA) after eight hours, so limiting the reuse period means that we don't have to perform rechecks. The order lifetime has been reduced to the sum of two authorization lifetimes, because there is little purpose to having an order that outlives the authorizations it depends on. The issued certificate omits the Common Name, as it is redundant with the Subject Alternative Names and is marked as NOT RECOMMENDED by the Baseline Requirements. The Key Encipherment key usage is omitted because it is only relevant when using non-forward-secret TLS cipher suites, which have been removed by all major browsers due to the importance of forward-secrecy. The Subject Key ID extension is omitted because it serves no purpose in end-entity certificates and is NOT RECOMMENDED by the Baseline Requirements. And finally the resulting certificate is valid for only 45 days, in preparation for upcoming restrictions that will limit all certificates to at most 47 days. diff --git a/content/en/post/2023-09-07-caa23.md b/content/en/post/2023-09-07-caa23.md index 7d702d087..1f55cdf73 100644 --- a/content/en/post/2023-09-07-caa23.md +++ b/content/en/post/2023-09-07-caa23.md @@ -3,10 +3,10 @@ author: Dan Fernelius date: 2023-09-07T00:00:00Z slug: caa23 title: "Increase your security governance with CAA" -excerpt: "Using Certificate Authority Authorization and Account & Method Binding is an easy way to enhance your DNS security." +excerpt: "Using Certification Authority Authorization and Account & Method Binding is an easy way to enhance your DNS security." --- -According to [Cloudflare's Merkle Town](https://ct.cloudflare.com/), 257,036 certificates are issued every hour. We at Let's Encrypt are issuing close to 70% of those certs. Being a Certificate Authority that operates as a nonprofit for the public's benefit means we are constantly considering how we can improve our Subscribers' experience and security. One simple innovation to do just that is by using [CAA (Certificate Authority Authorization)](https://letsencrypt.org/docs/caa/), and two CAA extensions for Account and Method Binding. +According to [Cloudflare's Merkle Town](https://ct.cloudflare.com/), 257,036 certificates are issued every hour. We at Let's Encrypt are issuing close to 70% of those certs. Being a Certificate Authority that operates as a nonprofit for the public's benefit means we are constantly considering how we can improve our Subscribers' experience and security. One simple innovation to do just that is by using [CAA (Certification Authority Authorization)](https://letsencrypt.org/docs/caa/), and two CAA extensions for Account and Method Binding. ## What is CAA?