Without a CAA record, any publicly trusted certificate authority may issue a certificate for your domain once its validation checks pass. A CAA record narrows this: "issue" names the CAs allowed to issue ordinary certificates, "issuewild" does the same for wildcard certificates, and "iodef" gives an address to which a CA can report refused requests.
The lookup climbs the tree. For www.example.com a CA first checks that exact name, then example.com, and uses the first CAA record set it finds, so one record at the apex covers every subdomain that does not have its own.
CAA is a control on issuance, not on browsers: browsers do not check it, and it does not invalidate certificates that were issued earlier. Its value is in reducing the number of CAs that could be tricked into issuing for your name. Remember to update it before you switch to a different CA, or renewals will be refused.
Example
example.com. 3600 IN CAA 0 issue "ca.example"
example.com. 3600 IN CAA 0 issuewild ";"
example.com. 3600 IN CAA 0 iodef "mailto:security@example.com"