Opensense SSL certificates from Let's Encrypt: CNAME and CAA requirements

Overview

Opensense uses Let’s Encrypt to issue and automatically renew the SSL/TLS certificates for hosted content that is served over HTTPS through custom CNAMEs that customers provide. This keeps communication secure, and removes the work of provisioning certificates and tracking their expiration.

These certificates are typically valid for 90 days, and are renewed automatically every 60 to 90 days, so encryption for customer-branded content and links continues without interruption.

Let’s Encrypt is shortening certificate lifetimes for all its users: to 64 days from February 10, 2027, and to 45 days from February 16, 2028 (see Decreasing Certificate Lifetimes to 45 Days). Opensense renews certificates automatically, so you don’t need to do anything.

Do you need to do anything?

Usually not. Opensense fully manages the certificate lifecycle. You only need to act if your domain has a CAA record that doesn’t include Let’s Encrypt. See When to update CAA records.

Customer CNAME requirements

When you configure a CNAME record that points to Opensense-hosted infrastructure (for example, for branded link tracking or email assets), Opensense requests a certificate from Let’s Encrypt for your domain.

For the certificate to be issued, Let’s Encrypt must be authorized to issue certificates for that domain. This usually needs no action, unless your domain restricts certificate authorities with DNS CAA records.

DNS CAA records and why they matter

A CAA (Certificate Authority Authorization) record is a DNS record that controls which certificate authorities (CAs) can issue SSL certificates for a domain.

CAA records that leave out Let’s Encrypt

If your domain has a CAA record that does not include Let’s Encrypt, certificate issuance fails, and HTTPS content served through your CNAME is inaccessible.

CAA records for Let’s Encrypt

If you use CAA records, authorize Let’s Encrypt explicitly with this DNS CAA record:

example.com.  CAA 0 issue "letsencrypt.org"

To support wildcard certificates (if applicable), also include:

example.com.  CAA 0 issuewild "letsencrypt.org"

Replace example.com with your actual domain: the root of the domain you’re creating the CNAME from.

When to update CAA records

Update your DNS CAA records only if both of these are true:

• You already have a CAA record (your domain is locked to specific CAs).
• Your current record does not include Let’s Encrypt as an authorized CA.

If no CAA records exist, all CAs (including Let’s Encrypt) are permitted by default, and no action is needed.

Supporting documentation

• Let’s Encrypt: Certificate Authority Authorization (CAA)
• IETF RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record

What’s next

• Required DNS settings for Opensense
• Verifying your Opensense DNS records

For questions or help, contact Opensense Support at help@opensense.com. Opensense Support can work with your IT team or DNS provider to verify the configuration.