---
title: "Opensense SSL certificates from Let's Encrypt: CNAME and CAA requirements"
slug: "opensense-ssl-certificates-using-letsencrypt"
description: "How Opensense gets SSL certificates for your branded CNAMEs from Let's Encrypt, and the CAA record you need if your domain restricts certificate authorities."
updated: 2026-10-14T00:00:00.000Z
canonical: "https://help.opensense.com/docs/opensense-ssl-certificates-using-letsencrypt"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.opensense.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Opensense SSL certificates from Let's Encrypt: CNAME and CAA requirements

## Overview

Opensense uses [Let's Encrypt](https://letsencrypt.org/) to issue and automatically renew the SSL/TLS certificates for hosted content that is served over HTTPS through custom CNAMEs that customers provide. This keeps communication secure, and removes the work of provisioning certificates and tracking their expiration.

These certificates are typically valid for **90 days**, and are renewed automatically every **60 to 90 days**, so encryption for customer-branded content and links continues without interruption.

Let's Encrypt is shortening certificate lifetimes for all its users: to 64 days from February 10, 2027, and to 45 days from February 16, 2028 (see [Decreasing Certificate Lifetimes to 45 Days](https://letsencrypt.org/2025/12/02/from-90-to-45/)). Opensense renews certificates automatically, so you don't need to do anything.


:::tip[Do you need to do anything?]
Usually not. Opensense fully manages the certificate lifecycle. You only need to act if your domain has a CAA record that doesn't include Let's Encrypt. See [When to update CAA records](#when-to-update-caa-records).
:::

## Customer CNAME requirements

When you configure a **CNAME record** that points to Opensense-hosted infrastructure (for example, for branded link tracking or email assets), Opensense requests a certificate from Let's Encrypt for your domain.

For the certificate to be issued, **Let's Encrypt must be authorized to issue certificates for that domain**. This usually needs no action, unless your domain **restricts certificate authorities with DNS CAA records**.

## DNS CAA records and why they matter

A **CAA (Certificate Authority Authorization)** record is a DNS record that controls which certificate authorities (CAs) can issue SSL certificates for a domain.

:::caution[CAA records that leave out Let's Encrypt]
If your domain has a CAA record that does *not* include Let's Encrypt, certificate issuance **fails**, and HTTPS content served through your CNAME is inaccessible.
:::


## CAA records for Let's Encrypt

If you use CAA records, authorize Let's Encrypt explicitly with this DNS CAA record:

```plaintext
example.com.  CAA 0 issue "letsencrypt.org"
```

To support wildcard certificates (if applicable), also include:

```plaintext
example.com.  CAA 0 issuewild "letsencrypt.org"
```

Replace `example.com` with your actual domain: the root of the domain you're creating the CNAME from.

## When to update CAA records

Update your DNS CAA records **only if** both of these are true:

- You **already have** a CAA record (your domain is locked to specific CAs).
- Your current record does **not include Let's Encrypt** as an authorized CA.

If no CAA records exist, all CAs (including Let's Encrypt) are permitted by default, and no action is needed.


## Supporting documentation

- [Let's Encrypt: Certificate Authority Authorization (CAA)](https://letsencrypt.org/docs/caa/)
- [IETF RFC 8659: DNS Certification Authority Authorization (CAA) Resource Record](https://datatracker.ietf.org/doc/html/rfc8659)


## What's next

- [Required DNS settings for Opensense](https://help.opensense.com/docs/dns-entries-must-have)
- [Verifying your Opensense DNS records](https://help.opensense.com/docs/how-to-check-your-dns-records)

For questions or help, contact Opensense Support at [help@opensense.com](mailto:help@opensense.com). Opensense Support can work with your IT team or DNS provider to verify the configuration.