ACM still giving CAA errors even after declaring proper CAA records
Context
I have a public hosted zone named company-sandbox.ninja and one private hosted zoned named intra.company-sandbox.ninja.
Everything was working fine, ssl certs (from ACM) for all domains and also for wildcard domains (declared in route53).
Now here comes the day where the certs for my private hosted zone expire, I need to recreate them. I manually re-create the certs ( not renew) in ACM console and set email validation, and after the verification I got the infamous error message:
One or more domain names has failed validation due to a certificate authority authorization (CAA) error.
So I define my CAA records in my public hosted zone, as seen in the doc, and I am still getting the same error. No matter if its DNS or email verification.
When i check on https://caatest.co.uk/ with intra.company-sandbox.ninja I get an ok response with the same content as I put in my CAA records.
So what can be causing this mind breaking error ?
Similar issues
- CNAME records forwarding to third parties Not my case, I have 0 CNAME records in any of my hosted zones.
- CAA check not passing. I am exacly in the same case as this guy and i have also tried to delete all CAA records.
Public hosted zone
Private hosted zone
SSL certs
- Newest
- Most votes
- Most comments
The issue you're experiencing with CAA errors for your private hosted zone certificates, even after declaring proper CAA records, can be frustrating. Here are a few potential reasons and solutions to consider:
-
CAA records for private hosted zones: CAA records are typically only checked for public DNS. For your private hosted zone (intra.company-sandbox.ninja), the CAA records in your public zone may not be applicable. ACM might be looking for CAA records specifically for the private domain, which don't exist in public DNS.
-
DNS propagation: Sometimes, DNS changes can take time to propagate. Although you've added the CAA records, it might take a while for these changes to be fully recognized across all DNS servers. You may want to wait for 24-48 hours and try requesting the certificate again.
-
Correct CAA record values: Ensure that your CAA records include the correct values for AWS Certificate Manager. The value field in your CAA record should contain one of these domain names: amazon.com, amazontrust.com, awstrust.com, or amazonaws.com.
-
Multiple CAA records: If you have multiple CAA records, make sure they don't conflict with each other. Sometimes, having both wildcard and specific domain CAA records can cause issues.
-
DNS configuration: Double-check that your DNS configuration is correct and that there are no conflicts between your public and private hosted zones.
-
ACM permissions: Ensure that ACM has the necessary permissions to issue certificates for your domains. This is especially important if you're using AWS Organizations or have complex IAM setups.
-
Certificate request timing: If you're requesting a new certificate immediately after deleting an old one, there might be some residual issues. Try waiting a short period before requesting a new certificate.
If none of these solutions work, you may want to contact AWS Support for further assistance, as there could be account-specific issues or edge cases that are causing this persistent error.
Sources
Certification Authority Authorization (CAA) problems - AWS Certificate Manager
Problem for CAA certificate renewal in ACM | AWS re:Post
Problem creating SSL certificate due to CA error | AWS re:Post
answered 2 years ago
I tried to create a certificate for another domain (that did not exist) and it work. With absolutly no change in my setup.
| Domain | Status |
|---|---|
| test.company-sandbox.ninja | ✅ no problem, validated in few minutes |
| intra.company-sandbox.ninja | ❌ same CAA error |
I think something is wrong with my DNS setup but dont know why...
answered 2 years ago
