SSL Certificate Checker / Utilities
CAA Record Generator
Build CAA records that name the certificate authorities allowed to issue for your domain, with wildcard rules, an incident contact and the account binding of RFC 8657, ready for your DNS host.
Zone file
example.com. 3600 IN CAA 0 issue "letsencrypt.org"
In a DNS host's form (Cloudflare, Route 53, GoDaddy): type CAA, name example.com (or @), flags 0, tag issue / issuewild / iodef, value as in quotes. CAA on example.com also covers every name under it unless a subdomain has its own. Check the certificate in use is allowed before you publish: the SSL Certificate Checker reads your CAA.
Check a live site
The SSL Certificate Checker reads the certificate your server actually sends, its chain, revocation, CAA and renewal health.
Open the SSL Certificate Checker