Every certificate authority in the root stores is, in principle, allowed to issue for any domain. As a domain owner you can restrict that, and you do it where your domain is already managed: in DNS. A CAA record states which CAs may issue certificates for your ... Continue Reading →