Can a CAA record prevent an SSL certificate from being issued for my domain?

Can a CAA record prevent an SSL certificate from being issued for my domain?

Yes. CAA records in DNS specify which certificate authorities may issue certificates for your domain. If an applicable rule does not allow the authority used for your requested certificate, issuance may be refused. Without applicable CAA records, this particular restriction does not apply, but the other certificate validation checks are still required.

Check the CAA records in your active DNS zone and ask your certificate provider which values are needed. Rules on a parent domain can also apply to subdomains, and wildcard certificates may need a separate check. Rather than deleting every rule to bypass the error, update the records according to the certificate authority's instructions and allow for DNS changes to take effect.

RELATED QUESTIONS

Here are a few more questions whose answers may interest you. We answer important, practical questions for our customers.

SUBSCRIBE TO OUR NEWSLETTER

Join our newsletter. We only use it to share important information.

Newsletter subscription illustration