This means that a site operator is ready to specify which Certificate Authorities (CA) are permitted to challenge a certificate for a specific resource - combatting the abusive follow exactly where a CA troubles certificates for a domain that doesn’t belong to the requesting bash. The Geek