跳至內容
使用 AWS re:Post 即表示您同意 AWS re:Post 使用條款
AWS re:Postre:Post
關於 re:Post

Certificate Manager failing CAA validation, with and without CAA records

0

I'm trying to request a certificate for a few hostnames. Each of the individual (DNS-based) validations is passing, however the certificate as a whole has a status of "Failed". The failure reason it gives is "CAA Error".

None of the domains (nor any of their parent domains) have CAA records set, so CAA validation should be disabled according to the ACM documentation. Regardless, I tried adding CAA records to the domains and re-requesting a certificate, and it still failed. I also tried requesting a certificate in a different region with the same results.

This has been going on since yesterday. Is there anything else I can try to fix this?

主題
安全性、身分識別與合規
標籤
AWS 憑證管理員
語言
English

已提問 7 年前檢視次數 1115 次

1 個回答
0

I solved it. For the benefit of any future thread viewers, it was because one of the hostnames was a CNAME that forwarded to a third party. That third party had a CAA record which prevented ACM from issuing a certificate for the name.

The fix was to remove or change the CNAME record before requesting a new certificate. This caused it to temporarily stop working, but allowed us to get the certificate and solve the problem. We were trying to make the change with zero downtime, which is why we didn't change the CNAME beforehand. But that wasn't realistic unfortunately.

已回答 7 年前

  • misak113
    3 年前

    This is something I came up with as well after a few days of getting crazy. I'd really appreciate some other way that does not require downtime (changing the current CNAME). I'd expect something like an extra CNAME or TXT record to make this valid. I.e.: TXT my.domain.example.com allowCAA. So the original service is still pointing to the existing external service and new service can generate certificates first, before it's swapped.

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋，同時有助於提問者的專業成長。

相關內容