I'd like to publish a CAA record for a domain and while I am familiar with the format I do not know what to use for the value. For example, Comodo certs would use
0 issue "comodoca.com" and Certbot would use
0 issue "letsencrypt.org". I need a way to look up what to use for the quoted value when it is not known.
I know that online CAA record generators exist but the CA I use is not listed. Is there a way to look this up online, or extract the value from one of the certificates in the trust chain?
In this instance, I'm trying to learn what to use for Amazon CloudFront (now that Route 53 supports CAA) but I would like to know how to find this value for any issuer. A CLI solution using
openssl would be great but an online list is fine also.
EDIT: Checking CAA records becomes mandatory for CA's two weeks from today, and comparing this incomplete list suggested in responses against Mozilla's list of CA's shows a huge discrepancy. For domain owners who wish to publish CAA records today and selectively whitelist trusted CA's, is there no reference material online?