Certificate Manager failing CAA validation, with and without CAA records

Question

I'm trying to request a certificate for a few hostnames. Each of the individual (DNS-based) validations is passing, however the certificate as a whole has a status of "Failed". The failure reason it gives is "CAA Error".  
  
None of the domains (nor any of their parent domains) have CAA records set, so CAA validation should be disabled according to the ACM documentation. Regardless, I tried adding CAA records to the domains and re-requesting a certificate, and it still failed. I also tried requesting a certificate in a different region with the same results.  
  
This has been going on since yesterday. Is there anything else I can try to fix this?

Answer

I solved it. For the benefit of any future thread viewers, it was because one of the hostnames was a CNAME that forwarded to a third party. That third party had a CAA record which prevented ACM from issuing a certificate for the name.  
  
The fix was to remove or change the CNAME record before requesting a new certificate. This caused it to temporarily stop working, but allowed us to get the certificate and solve the problem. We were trying to make the change with zero downtime, which is why we didn't change the CNAME beforehand. But that wasn't realistic unfortunately.

Certificate Manager failing CAA validation, with and without CAA records

관련 콘텐츠