Cert Renewal Fails Due to CAA mismatch, Can't Authorize Additional CA

0

I recently received an email that AWS failed to renew certificates for subdomains whose DNS is through Route53. The root domain uses a certificate from another authority. There is a mismatch in the CAA records because the current record is for the root domain which uses a certificate from the different certificate authority, so AWS fails to renew. Fine, I thought... I will just add the appropriate record to additionally authorize AWS.

Now, research tells me that you cannot list multiple authorities in a single CAA record, and that the appropriate process is to create multiple CAA records. But:

  • Route53 errors when attempting to create another CAA record for the root, complaining the record already exists (research says this actually should be valid).
  • Route53 errors when attempting to create a CAA record for the specific subdomains under the AWS certificate, complaining that the subdomain.example.com CAA is in conflict with example.com CAA (research says this actually should be valid).

So it seems that AWS Route53 implementation of CAA is bugged and it is not possible to renew my AWS certificates unless AWS can alter their own code. Please advise.

已提問 2 年前檢視次數 409 次
1 個回答
0

Thank you for the detailed analysis/description.

CAA record type is supported in Route 53 while we might consider its format listed in doc [1], especially that the coexistence of CAA and CNAME record with the same name is not allowed.

For example via the Route 53 Console, creating a single CAA record to include all of the required CAs should be sufficient for ACM validation:

Route 53 Console

More CAA record examples are available in https://docs.aws.amazon.com/acm/latest/userguide/setup-caa.html while I also find https://aws.amazon.com/premiumsupport/knowledge-center/acm-troubleshoot-caa-errors/ extremely helpful in understanding how CAA validation works in ACM.

If the issue persists, please feel free to provide additional information for further discussion.


[1] https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/ResourceRecordTypes.html#CAAFormat

AWS
weidi
已回答 2 年前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南