# Let's Encrypt accounturi for CAA record **URL:** \ **Category:** Support\ **Tags:** netlify-dns-https-ssl\ **Created:** [October 2, 2023, 2:49pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453 "2023-10-02T14:49:15Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![sethvargo](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/sethvargo/32/55125_2.png) [@sethvargo](https://answers.netlify.com/u/sethvargo)\ **Post date:** [October 2, 2023, 2:49pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/1 "2023-10-02T14:49:15Z")
Hi there - I want to further lock down my CAA record by allowing **only** Netlify’s Let’s Encrypt account issue certificates. I currently have the following DNS records: ```auto mydomain.com. 5 IN CAA 0 iodef "mailto:abuse@mydomain.com" mydomain.com. 5 IN CAA 0 issue "letsencrypt.org" ``` However, this allows _any_ Let’s Encrypt account to create certificates for my domain. I would like to add the [`accounturi` parameter](https://letsencrypt.org/docs/caa/#the-accounturi-parameter) which takes the form: ```auto https://acme-v02.api.letsencrypt.org/acme/acct/1234567890 ``` What is Netlify’s Let’s Encrypt accounturi? I recognize that not all CAs will recognize the `accounturi` parameter, but Let’s Encrypt is the only CA I use. Could the accounturi please be shared and added to the documentation? ---
**Author:** ![fool](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/fool/32/37_2.png) [@fool](https://answers.netlify.com/u/fool)\ **Post date:** [October 2, 2023, 9:28pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/2 "2023-10-02T21:28:07Z")
I don’t think we can give that out. If you have more specific needs like this, you should get your own custom certificate (e.g. one from lets encrypt) and upload/manage it yourself. Sorry I don’t have better news for you today! ---
**Author:** ![sethvargo](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/sethvargo/32/55125_2.png) [@sethvargo](https://answers.netlify.com/u/sethvargo)\ **Post date:** [October 2, 2023, 9:49pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/3 "2023-10-02T21:49:00Z")
Sorry, I’m not sure I understand why you can’t give it out? CAA records are part of the public DNS record, so I don’t see what LE would recommend adding an accounturi parameter if it wasn’t intended to be public. Even [netlify.com](http://netlify.com) encodes their [digicert.com](http://digicert.com) account into the CAA record: ```auto $ dig CAA netlify.com +short 128 issue "digicert.com;account=2d83e9ac9b6776c3f215150f6ebceea8cefe3bc2e1fb5efffb1d71e200575226" 128 issue "amazon.com" 128 iodef "mailto:security@netlify.com" ``` As does Facebook: ```auto dig CAA facebook.com +short 0 issue "digicert.com; account=271b0beda0771d006aa3a6c11b05187d456d6c239b46cb5241196095b09c92af" ``` The account _key_ is the secret part that should not be shared externally. ---
**Author:** ![fool](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/fool/32/37_2.png) [@fool](https://answers.netlify.com/u/fool)\ **Post date:** [October 6, 2023, 10:08pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/4 "2023-10-06T22:08:17Z")
I’ll ask our networking team. The fact that we have never given it out after issuing millions of certificates via lets encrypt just makes me think it is not something we give out. Nobody else has ever - in the history of using Netlify - needed that information. So I think the request is probably not necessary for any use cases we want to support, but I shall ask instead of assuming further. I expect we’ll get an answer later next week. ---
**Author:** ![fool](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/fool/32/37_2.png) [@fool](https://answers.netlify.com/u/fool)\ **Post date:** [October 10, 2023, 6:07pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/6 "2023-10-10T18:07:59Z")
Thanks for your patience! Team agreed with your assessment, so here’s the account ID (presumably just the digits at the end). **`https://acme-v02.api.letsencrypt.org/acme/acct/54403714`** I’ll be curious to hear if you are able to configure a CAA record successfully - let us know how it goes! ---
**Author:** ![sethvargo](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/sethvargo/32/55125_2.png) [@sethvargo](https://answers.netlify.com/u/sethvargo)\ **Post date:** [October 10, 2023, 10:35pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/7 "2023-10-10T22:35:12Z")
Hey - thank you for that :). Based on my [understanding of the docs](https://letsencrypt.org/docs/caa/#the-accounturi-parameter), I think the CAA records expects the full URL (e.g. `letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/54403714`) Anyway, here’s the current CAA record for [sethvargo.com](http://sethvargo.com): ```auto sethvargo.com. 300 IN CAA 0 iodef "mailto:abuse@sethvargo.com" sethvargo.com. 300 IN CAA 0 issue "letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/54403714" ``` I attempted to click “renew certificate” from Netlify. I don’t get an error, but I also don’t get a new certificate. I’m not sure how to tell if it’s succeeding beyond waiting 2 months and seeing if it fails? I haven’t gotten an error, but Cloudflare is also supposed to email me when a new cert is issued for my domain, and I haven’t gotten an email. Is there a place where I could look for logs for failures on the Netlify side? ---
**Author:** ![sethvargo](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/sethvargo/32/55125_2.png) [@sethvargo](https://answers.netlify.com/u/sethvargo)\ **Post date:** [October 10, 2023, 10:39pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/8 "2023-10-10T22:39:55Z")
Do y’all happen to stage certs first or use dry-run? ([reference](https://community.letsencrypt.org/t/failing-to-use-accounturi-in-production/190060/3)) ---
**Author:** ![fool](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/fool/32/37_2.png) [@fool](https://answers.netlify.com/u/fool)\ **Post date:** [October 11, 2023, 8:35pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/9 "2023-10-11T20:35:50Z")
Not sure about the answer to those last two questions (I think the answer is no), but I can tell you we won’t even attempt a renew via any user-attempted method, until/unless the cert is closer to expiration. I just renewed via our API and it seemed to work…er…hmm. It updated a `last_successful_renewal_at` timestamp to today, but I don’t see the expires\_at timestamp extending which makes me think that may just be an internal designator rather than us actually going via LE. You could _definitely_ trigger a renewal by adding a new domain alias though - maybe you have a way to easily create a dummy domain name you can add in there that points to us (which you can of course remove thereafter) to test things out? ---
**Author:** ![sethvargo](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/sethvargo/32/55125_2.png) [@sethvargo](https://answers.netlify.com/u/sethvargo)\ **Post date:** [October 11, 2023, 11:05pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/10 "2023-10-11T23:05:56Z")
Ah got it - I misunderstood how renewal works. I can confirm adding a subdomain and renewing successfully provisions a new and valid cert 🙂 Any chance of adding an example to the Netlify docs? I do think it’s a risk that customers set CAA records that allow _anyone_ with a LE account to provision certs instead of restricting it to specific accounts. ---
**Author:** ![hrishikesh](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/hrishikesh/32/74607_2.png) [@hrishikesh](https://answers.netlify.com/u/hrishikesh)\ **Post date:** [October 15, 2023, 6:03pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/12 "2023-10-15T18:03:49Z")
We’ve asked the docs team to review this thread. ---
**Author:** ![Kristen](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/kristen/32/279_2.png) [@Kristen](https://answers.netlify.com/u/Kristen)\ **Post date:** [November 1, 2023, 2:34pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/15 "2023-11-01T14:34:27Z")
@sethvargo - Thanks for your suggestion about how we could improve our docs! I wanted to let you know that we’ve updated our docs on [Netlify-managed certificates](https://docs.netlify.com/domains-https/https-ssl/#netlify-managed-certificates) to include Netlify’s `accounturi`. Thanks again! ---
**Author:** ![sethvargo](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/sethvargo/32/55125_2.png) [@sethvargo](https://answers.netlify.com/u/sethvargo)\ **Post date:** [November 1, 2023, 2:49pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/16 "2023-11-01T14:49:47Z")
Thanks! I think you linked to the [deploy preview](https://deploy-preview-3697--docs.netlify.com/domains-https/https-ssl/#netlify-managed-certificates) (which I don’t have access too), but I found it linked on the [public docs](https://docs.netlify.com/domains-https/https-ssl/#netlify-managed-certificates). Thank you so much - this is really great for customers! ---
**Author:** ![Kristen](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/kristen/32/279_2.png) [@Kristen](https://answers.netlify.com/u/Kristen)\ **Post date:** [November 1, 2023, 3:08pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/17 "2023-11-01T15:08:30Z")
oops! Sorry about that and thanks for letting me know. I updated the link in my original message ---
**Author:** ![anon92373221](https://avatars.discourse-cdn.com/v4/letter/a/ed655f/32.png) [@anon92373221](https://answers.netlify.com/u/anon92373221)\ **Post date:** [November 1, 2023, 11:27pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/18 "2023-11-01T23:27:18Z")
Thanks a lot for the addition in the doc, I was just looking for that too 🙏 However, just out of curiosity, this is the very first time I’ve seen a CAA record with just the account address, with nothing in front of it, compared to what we find here: [Certificate Authority Authorization (CAA) - Let's Encrypt](https://letsencrypt.org/docs/caa/#the-validationmethods-parameter) Do you know if it’s possible to add a validation method for this record? validationmethods=http-01 validationmethods=dns-01 validationmethods=tls-alpn-01 Thanks again ---
**Author:** ![hrishikesh](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/hrishikesh/32/74607_2.png) [@hrishikesh](https://answers.netlify.com/u/hrishikesh)\ **Post date:** [November 2, 2023, 6:36pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/19 "2023-11-02T18:36:35Z")
When using Netlify DNS, we use DNS validation, when using external DNS, we use HTTP validation. You can add that accordingly. ---
**Author:** ![anon92373221](https://avatars.discourse-cdn.com/v4/letter/a/ed655f/32.png) [@anon92373221](https://answers.netlify.com/u/anon92373221)\ **Post date:** [November 2, 2023, 7:00pm UTC](https://answers.netlify.com/t/lets-encrypt-accounturi-for-caa-record/103453/20 "2023-11-02T19:00:30Z")
Thank you for these clarifications 👌