Docs
Docs
Open dashboard
Troubleshooting

caa_blocks_issuance

A CAA record on the customer's domain doesn't allow our certificate authority to issue for it.

Seen in cert_failedFix is on the customer's sideRetry after the fix

What it means

CAA records let a domain owner name the certificate authorities allowed to issue for it. The customer's domain (or a parent of it) has CAA records, and none of them allows Let's Encrypt. DNS is verified and the domain is routed; it just cannot get a certificate, so it sits in cert_failed.

ExpectedCAA@ → 0 issue "letsencrypt.org"
FoundCAA@ → 0 issue "digicert.com"

status_detail.expected is the exact record to add; status_detail.registrable is the zone it goes on.

Why it happens

  • The company restricts issuance to the CA it buys its own certificates from, and the policy predates this domain.
  • A security scanner recommended adding CAA records and only the existing CA was listed.
  • The CAA record sits on the registrable domain (acme.com) and so applies to every subdomain, including the one you added.

What to do

  1. Ask the customer to add 0 issue "letsencrypt.org" at the root of their domain, next to their existing CAA records. Adding a record does not weaken their policy for anything else.
  2. Or remove the CAA records entirely, if they are not needed.
  3. Then retry: POST /v1/domains/{id}/verify or "Retry issuance" in the dashboard. We look the CAA records up again first, and only order the certificate once they allow it. We also re-check on our own with backoff (1 min, 5 min, 30 min, 2 h, then every 12 h).
Was this helpful?
Edit this page