Hacker News Reader

Will browsers actually refuse a 'valid' cert if my DNS record indicates a different CA than the one presented?

No, the check is done when the CA issues the cert. This allows you to change your CAA record without making your cert invalid (see also https://tools.ietf.org/html/rfc6844#page-2)

Reply on news.ycombinator.com