Forum Discussion

winterfell_2234's avatar
winterfell_2234
Icon for Nimbostratus rankNimbostratus
Feb 26, 2019

Anyone tried creating CAA DNS records on BIG IP 13.X.X ?

Anyone tried creating CAA DNS records on BIG IP 13.X.X? I tried manually editing the zone file but it did not work.

 

1 Reply

  • I haven't upgraded my lab VMs in a very long time, but i was to get to work in 11.5 by modifying the bind file directly as at least in 11.x there is not CAA type listed from drop down in the Webgui.

    Here is an example of what the top part of my zone file looks like. You may be having a syntax issue with how ever you added yours into the zone file. If you do a google search for say "CAA Recod Helper" you can find several examples and or tools that will create the output you need to drop in. Some even list out most of the known CAs and the appropriate string for them. Then after you add, use a cert tool like from SSL Labs and the check will show the CAA is being picked up.

    Only thing i don't know if, is if this will stay in the event of a reboot. In my brief testing It will sync to the other GTMs , but only after you make a GTM via TMSH or Webgui to trigger replication.

    $ORIGIN .
    $TTL 180        ; 3 minutes
    yourdomain.com          IN SOA  ns01.yourdomain.com. hostmaster.ns01.yourdomain.com. (
                                    2017090244 ; serial
                                    10800      ; refresh (3 hours)
                                    3600       ; retry (1 hour)
                                    604800     ; expire (1 week)
                                    86400      ; minimum (1 day)
                                    )
                            NS      ns01.yourdomain.com.
                            NS      ns02.yourdomain.com.                        
                            IN CAA  0 isssue ";"
                            IN CAA  0 issuewild "sectigo.com"