Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

cannot authenticate domain with AWS Certificate manager, for domain hosted on Route53

0

We have a public domain that is hosted on AWS route53, when I am trying to create a certificate for wildcard subdomain and domain, it fails sometimes. For example:

  • test.domain.name - fails
  • test1.domain.name - success
  • test2.domain.name - success
  • *.test.domain.name - failure

The message I get is cryptic

One or more domain names has failed validation due to a certificate authority authorization (CAA) error.

What is interesting is some of the domains' validation successes and some fails

Topics
Security, Identity, & ComplianceNetworking & Content Delivery
Tags
Amazon Route 53AWS Certificate Manager
Language
English

asked a year ago181 views

1 Answer
0

The issue you're experiencing with AWS Certificate Manager (ACM) failing to authenticate some domains while succeeding with others is likely related to Certificate Authority Authorization (CAA) records. CAA records are DNS records that specify which Certificate Authorities (CAs) are allowed to issue certificates for a domain.

To resolve this issue, you should:

  1. Check for existing CAA records: Use DNS lookup tools like dig or nslookup to check for CAA records on your domain and subdomains.

  2. Add or modify CAA records: If CAA records exist and are blocking ACM, you'll need to add a CAA record that allows Amazon to issue certificates. The record should look like this: 0 issue "amazon.com"

  3. Ensure proper DNS propagation: After adding or modifying CAA records, allow time for DNS changes to propagate globally (up to 24-48 hours).

  4. Verify DNS configuration: Double-check that your DNS records (CNAME and A records) are correctly set up in Route 53. Ensure that the NS (Name Server) records in your domain registrar match those in the Route 53 hosted zone.

  5. Check permissions: Verify that you have the necessary IAM permissions to create records in your Route 53 hosted zone and to manage ACM certificates.

  6. Region consideration: Ensure the ACM certificate you're creating is in the correct AWS region for your intended use.

If the problem persists after implementing these steps, you may need to delete the failed certificate requests and initiate new ones. Monitor the status of your new certificate requests in the ACM console. If successful, the status will change to "Issued" within 72 hours.

If you continue to experience issues, it's advisable to use tools like dig or nslookup to verify your DNS configuration thoroughly. In case the problem persists, you may need to contact AWS Support for further assistance.
Sources
Unable to request a Certificate in AWS | AWS re:Post
Problem creating SSL certificate due to CA error | AWS re:Post
Why am I not able to add a custom SSL for my Domain? I tried with 2 separate services. Details in description. | AWS re:Post

answered a year ago

EXPERT

reviewed a year ago

  • Alec
    a year ago

    This gave me the right direction, the issue is related to transition from letsencrypt.org to AWS certificate. It would be nice if the AWS error was specific, to suggest that which subdomain CAA record is with other authority. That would save me a lot of time. The instructions for checking existing CAA records, should for this scenario, suggest to check first with Route53 which is an AWS property, and could definitely point me to the place I need to change instead just the generic message.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content