I am fiddling around with certificates, trying to harden my own sites. When doing so, I noticed that Google have some weird configuration of their CAA.

Looking at their ssllabs results, or using normal Linux cli:

me { ~ }$ dig google.com CAA +short
0 issue "symantec.com"
0 issue "pki.goog"

You can see that google have listed symantec.com as a certificate authority that are allowed to issue certificates for they domain.

Based on some resent news, I would imagine Google doing the exact opposite, ie, pinning symantec to never issue a google certificate.

Does anyone know of a good reason for this? Or am I not understanding the whole picture?

Update: Just saw isc.sans.org published a diary about CAA a couple of hours after I asked this. No enlightenment tho..

  • I'm not sure if CAA actually adds any benefits (maybe it will now that it is mandatory). It also does not seem to be used by anybody except google. Still an interesting question though.
    – tim
    Apr 25, 2017 at 20:45

1 Answer 1


Google still uses the issuing intermediate certificate (Google Internet Authority G2), signed by Geotrust (a part of Symantec group). Perhaps, this is the indirect reason why they have to keep symantec.com whitelisted in CAA. https://pki.google.com/

They have obtained their own root certificates recently, so they will stop using third-party CAs sooner or later. https://pki.goog/ is their own CA from now on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .