Add an issue tag to your CAA record on Cloudflare
Why it matters
The CAA record set has no `issue` property (issuewild only limits wildcard certificates), so it does not restrict which authorities may issue ordinary certificates. It gives a false sense of control.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Open DNS then Records, add a CAA record for each CA, choosing the tag that allows specific hostnames (issue), and enter the CA's domain.
- Once the zone has any CAA record, Cloudflare adds records for its Universal SSL CAs (Google Trust Services, Let's Encrypt, SSL.com and Sectigo). They are not shown in the dashboard, so check with dig CAA example.com +short. Advanced Certificate Manager certificates are not covered, so add their CA yourself.
The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.