# CAA review before an event-site certificate change

Use one line per hostname and certificate context. This worksheet records the intended certificate authority (CA), effective CAA policy, responsible DNS owner and observed outcome. It is not an instruction to change DNS blindly. Do not paste private keys, DNS credentials or account tokens here.

## 1. Inventory the certificate path

| Event / edition | Hostname and certificate role (edge/origin) | Certificate requester/renewal service | Current issuer (clue only) | Intended issuer and authoritative provider source | Wildcard/SAN scope | DNS owner |
| --- | --- | --- | --- | --- | --- | --- |
| [ ] | [event.example.org / edge] | [ ] | [ ] | [ ] | [ ] | [ ] |
| [ ] | [tickets.example.org / origin] | [ ] | [ ] | [ ] | [ ] | [ ] |

**Certificate provider documentation or support confirmation for required CAA values:** [link, date, contact]

## 2. Record DNS evidence

| Hostname queried | Parent or CNAME path checked per provider guidance | issue values | issuewild values | Query source and time/zone | Does it permit intended issuer? |
| --- | --- | --- | --- | --- | --- |
| [ ] | [ ] | [ ] | [ ] | [ ] | [yes/no/unclear] |

No CAA record is not automatically a certificate error. If CAA exists and restricts issuance, confirm its effect with the certificate provider. CAA authorization is separate from HTTP or DNS domain-control validation.

## 3. Review the exact change

- **Change or no-change decision and rationale:** [ ]
- **Other active certificates/issuers that may be affected:** [ ]
- **Exact proposed record values and provider source:** [ ]
- **Authoritative DNS zone/account and implementer:** [ ]
- **Technical/service approver and approval time:** [ ]
- **Change ticket and rollback owner:** [ ]

Some managed platforms publish CAA automatically or use multiple certificate authorities. Inspect public DNS answers and confirm current platform guidance before changing a policy.

## 4. Confirm the result

| Hostname | Provider issuance/renewal status | Served certificate issuer and validity observed | HTTPS event/registration/ticket journey | Observation time and verifier | Remaining issue |
| --- | --- | --- | --- | --- | --- |
| [ ] | [ ] | [ ] | [ ] | [ ] | [ ] |

A successful DNS query does not prove issuance or HTTPS. If renewal still fails, keep the provider’s exact error and separate CAA rejection from domain validation or other failures.

Sources: [Let’s Encrypt CAA](https://cps.letsencrypt.org/ca/docs/caa/), [AWS ACM CAA troubleshooting](https://docs.aws.amazon.com/acm/latest/userguide/troubleshooting-caa.html), [Cloudflare CAA](https://developers.cloudflare.com/ssl/edge-certificates/caa-records/).