{
  "synthetic": true,
  "execution": "Teaching record only; no live integration tested",
  "slug": "certificate-issuance-caa-evidence",
  "group": "operations",
  "title": [
    "A certificate launch needs CAA evidence as well as DNS",
    "证书上线，要核对CAA而不只看解析"
  ],
  "intro": [
    "A website launch can resolve the right IP yet wait for certificate issuance. Before changing DNS or certificate suppliers, commission a read-only evidence pack that separates hostname routing, issuer permission and actual certificate status. Do not delete security records as a troubleshooting shortcut.",
    "网站能解析到正确IP，证书签发仍可能等待。修改DNS或换证书供应商前，应先整理只读证据，把域名路由、签发机构许可及实际证书状态分开，不能把删除安全记录当排障捷径。"
  ],
  "facts": [
    [
      "Cloudflare explains that CAA specifies permitted certificate authorities and that inherited parent-domain records can matter. Automatic records differ between Universal SSL and Advanced certificates.",
      "Cloudflare说明CAA指定可签发机构，父域继承可能影响结果；Universal SSL与Advanced证书的自动记录行为不同。",
      "https://developers.cloudflare.com/ssl/edge-certificates/caa-records/"
    ]
  ],
  "columns": [
    [
      "Synthetic launch evidence",
      "What it establishes",
      "What remains unknown"
    ],
    [
      "合成上线依据",
      "能证明什么",
      "仍未知什么"
    ]
  ],
  "example": [
    [
      [
        "www resolves to expected host",
        "Routing observation",
        "Certificate issuance/hostname coverage"
      ],
      [
        "www解析到预期主机",
        "路由观察",
        "签发及域名覆盖"
      ]
    ],
    [
      [
        "Parent CAA only permits ca-a.example",
        "Declared issuer policy",
        "Whether chosen supplier uses that authorised CA"
      ],
      [
        "父域CAA仅允许ca-a.example",
        "声明的签发策略",
        "供应商实际CA是否获允许"
      ]
    ],
    [
      [
        "Dashboard has no visible automaticCAA",
        "UI observation only",
        "Public DNS may include provider-added records"
      ],
      [
        "面板看不到自动CAA",
        "只是界面观察",
        "公开DNS可能含平台添加记录"
      ]
    ],
    [
      [
        "Certificate statusActive; SAN containswww",
        "Issuer reports active matching certificate",
        "Actual TLS presentation still needs verification"
      ],
      [
        "证书Active且SAN含www",
        "平台显示匹配证书活动",
        "真实TLS呈现仍须核验"
      ]
    ]
  ],
  "steps": [
    [
      "Record exact hostname, authoritative DNS provider, parent/subdomain arrangement and certificate product. Read current CAA answers and inheritance with timestamps; keep unrelated records untouched.",
      "记录准确域名、权威DNS商、父子域设置及证书产品；只读记录带时间的CAA及继承，不动其他记录。"
    ],
    [
      "Ask the hosting supplier for the intended issuer, validation status and supported CAA guidance. Compare observed DNS with that exact product instead of copying a generic allow-list.",
      "向主机供应商索取拟用签发机构、验证状态及该产品CAA指导，按准确产品对照，不能复制通用允许清单。"
    ],
    [
      "Have the authorised owner approve any proposed DNS change separately. After authorised issuance, verify hostname/SAN, chain, expiry and actual TLS response before declaring the launch ready.",
      "任何DNS修改须由负责人另行批准；获准签发后核对域名SAN、链、期限及真实TLS响应，再判断能否上线。"
    ]
  ],
  "result": [
    "The matrix keeps a routing success from becoming a certificate success claim. A CAA mismatch is one candidate explanation, not the established cause of every pending certificate. The evidence pack should preserve both the public answer and the platform status so a supplier can resolve the actual layer.",
    "矩阵避免把解析成功叫证书成功。CAA不符只是候选原因，不是所有等待签发的既定原因；证据包应保留公开回答及平台状态，帮助供应商定位真实层次。"
  ],
  "accept": [
    "Require consistent hostname, issuer permission, successful validation and live TLS evidence. Unknown product or inherited records block an issuance conclusion, not justify weakening policy.",
    "须域名、签发许可、验证及真实TLS证据一致；产品或继承未知时暂缓结论，不能以此削弱策略。"
  ],
  "limit": [
    "Synthetic domain names and statuses; no DNS query, configuration change, certificate purchase or security bypass was performed. This is not a universal Cloudflare/Sites setup procedure.",
    "域名及状态均合成；没有查真实DNS、改设置、买证书或绕过安全，也不是通用Cloudflare或Sites配置教程。"
  ]
}