> ## Content Index
> Fetch the complete content index at: https://www.ctrl.blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# How to prevent Let’s Encrypt from issuing certificates for your domain
- URL: https://www.ctrl.blog/entry/how-to-block-letsencrypt/
- Published: 2017-07-20T09:17:00.000Z
- Updated: 2026-08-23T22:09:22.000Z
- Description: Let’s Encrypt has made it really easy to obtain TLS certificates. Here is how to block the service from issuing certificates for your domains.
- Author: Daniel Aleksandersen
- Tags: DNS, Security

Are you acquiring your certificates from a certificate authority other than Let’s Encrypt? Now you can block Let’s Encrypt and certificate authorities other than the ones you’ve a relationship with from misissuing certificates for your domain. All it takes are a few extra DNS records.

Let’s Encrypt has automated the certificate issuance and renewal process entirely and has lowered the cost and technical barrier to deploying client-to-server encryption on the web. Certificates are issued for any domain that can pass a set of challenges, which revolve around demonstrating control over the standard port for web traffic (TCP 80) for a given domain’s `A` or `AAAA` (IPv4 or IPv6) records.

As an additional security measure, Let’s Encrypt will also check and verify any `CAA` records for the domain stored in DNS. `CAA`, or certificate authority authorization records, are a set of instructions specifically for CAs that can be used to grant exclusive issuance permissions to one or more CAs.

Let’s Encrypt was one of the very first CAs to implement checks for `CAA` records. They will query DNS for `CAA` records from multiple geographically dispersed locations around the worlds. If a conflicting `CAA` records is found, than they will refuse to issue a certificate for a domain.

If you’ve configured multiple DNS service providers to act as nameservers for your domain, than Let’s Encrypts approach helps protect your domain even if one nameserver may have been compromised by an attacker.

Assuming you only want to block Let’s Encrypt and anyone but DigiCert from issuing certificates for your domain, you can let any CA that ask about this know using the following DNS records (shown below in `bind` format):

```
example.com.  IN  CAA  0 issue "digicert.com"
example.com.  IN  CAA  0 issuewild ";"
```

The above example says that only a certificate authority that self-identifies as `digicert.com` can issue a certificate for the `example.com domain`. Furthermore it says that only a CA that identifies as an empty string (meaning no one) can issue a wildcard certificate for the domain.

There are a couple of more `CAA` records you should set which I go in to more detail about in a [past article](https://www.ctrl.blog/entry/dns-caa/). You also need to set `CAA` records for any subdomain, including `www`, in addition to your root domain. You should review my previous article in detail before deploying any `CAA` records on your domains.

All CAs have agree to start checking `CAA` records by September 2017.

#### Sources

- [Automatic Certificate Management Environment (ACME)](https://web.archive.org/web/20170405094129/https://datatracker.ietf.org/doc/html/draft-ietf-acme-acme-06), 2017-03-13 ACME Working Group
- [/cdr/resolver.go](https://github.com/letsencrypt/boulder/blob/d92baeee873ce2a972b51fb3c3f8b36eaa58b46e/cdr/resolver.go?ref=ctrl.blog), 2016-11-30, revision d92baeee873c, letsencrypt/boulder project, GitHub
- [RFC 6844: DNS Certification Authority Authorization (CAA) Resource Record](https://www.rfc-editor.org/rfc/rfc6844.html?ref=ctrl.blog), 2013-01, Internet Engineering Task Force