Skip to content

SSL generation for a domain managed by AWS Hosted Zone

0

When I am trying to renew SSL for domain digitup.in I am getting this error, even if I have added CAA record for this domain as well. Still getting this error.

I am trying to generate certificate on Netlify which provides Let's encrypt certificate.

SniCertificate::CertificateNonvalidError: SniCertificate::CertificateNonvalidError: Unable to verify challenge for digitup.in: During secondary validation: DNS problem: SERVFAIL looking up CAA for digitup.in - the domain's nameservers may be malfunctioning

asked 2 years ago173 views

1 Answer
0

Your NS and CAA records are as follows

% dig +short NS digitup.in
ns-928.awsdns-52.net.
ns-1454.awsdns-53.org.
ns-1806.awsdns-33.co.uk.
ns-485.awsdns-60.com.
% dig +short CAA digitup.in
0 issuewild "letsencrypt.org"
0 issue "letsencrypt.org"
%

According to their documention, the CAA record need to be created as follows

To ensure that only Netlify can create Let’s Encrypt certificates for your custom domain, you can add a Certificate Authority Authorization (CAA) record to your DNS provider that specifies Netlify’s accounturi, which is https://acme-v02.api.letsencrypt.org/acme/acct/54403714.

which means something like below

% dig +short CAA   digitup.in
0 issue "letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/54403714"

Do edit your existing CAA records, and change value from 0 issue "letsencrypt.org" to 0 issue "letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/54403714"

As per Netlify documentation

If you’re having trouble with the automatic provisioning, visit the troubleshooting page for an error message guide and other tips. You can also visit our Forums for a verified Support Guide on SSL / TLS certificate provisioning

AWS
EXPERT

answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.