Let's Encrypt Using ACME CAA Account Binding

Certification Authority Authorization (CAA), specified by RFC 8659, allows domain owners to use DNS records to restrict which Certificate Authorities are permitted to issue certificates for a domain.

Let's Encrypt has supported CAA for many years, and CAA processing is required by the CA/Browser Forum Baseline Requirements for publicly trusted Certificate Authorities.

Account Binding and Validation Method Binding are extensions to CAA specified by RFC 8657.

Validation Method Binding

Subscribers can restrict which domain-control validation methods may be used, such as DNS-01, HTTP-01, or TLS-ALPN-01, by specifying them with the validationmethods parameter in a CAA record.

ACME Account Binding

Subscribers can also restrict issuance to a specific ACME account by including the account's unique URL in the accounturi parameter of the CAA record.

See the RFC specifications above for the exact syntax and processing requirements for CAA records.

Let's Encrypt has supported these features in its ACME infrastructure. If unexpected certificate issuance failures occur, verify the domain's CAA records and the configured ACME account URI.

The following example demonstrates the CAA policy used for charlotte.edu.

External CAA validation: caatest.co.uk/charlotte.edu

0 issue "letsencrypt.org; accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/1726001367"
0 issue "amazon.com"
0 issue "godaddy.com"
0 issue "digicert.com"
128 iodef "mailto:hostmaster@uncc.edu"
0 issue "sectigo.com"

Certbot can display information about the ACME account currently registered on the server.

$ sudo certbot show_account

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Account details for server:
https://acme-v02.api.letsencrypt.org/directory

Account URL:
https://acme-v02.api.letsencrypt.org/acme/acct/1726001367

Email contact:
someuser@charlotte.edu

The value following Account URL is the value used for the CAA accounturi parameter.

The site acme-lecaa.charlotte.edu demonstrates certificate issuance through the authorized Let's Encrypt ACME account.

Issue / Expiration Dates

notBefore=May 17 16:55:28 2024 GMT
notAfter=Aug 15 16:55:27 2024 GMT

Serial Number

03:b0:fd:36:69:4f:57:64:aa:eb:ef:2d:23:28:51:b1:91:86

Intermediate Certificate

issuer=C=US, O=Let's Encrypt, CN=R3

ACME CAA adds another level of authorization to a standard CAA policy. Instead of specifying only which Certificate Authority can issue a certificate, the domain owner can also specify the individual ACME account that is authorized to request the certificate.

example.com. IN CAA 0 issue "letsencrypt.org; accounturi=https://some/lets-encrypt/account-id"

This strengthens certificate issuance controls because authorization is tied both to the selected Certificate Authority and to a designated ACME account.

Even if another party were able to satisfy an ACME domain-validation challenge, the Certificate Authority would still need to evaluate the domain's CAA policy before issuing the certificate.

• RFC 8659 — Certification Authority Authorization (CAA)
• RFC 8657 — CAA Extensions for Account URI and Validation Methods
• RFC 8555 — ACME Account Management
• Let's Encrypt Community — Enabling ACME CAA Account and Method Binding
• Hugo Landau — ACME CAA Account Binding