SSL guides & resources
CAA records and SSL issuance failures: what to check
Understand how CAA controls certificate issuance. Check inherited records, issuer identifiers, DNS errors and wildcard policy without disrupting other services.
This guide covers issuer authorization, not the TXT or CNAME challenge used to prove domain control. Keeping those two jobs separate helps avoid an unsafe fix: deleting every CAA record simply because a new order is pending.
List all certificate users before editing policy. Your hosting AutoSSL service, CDN and manually purchased certificate may use different authorities. A change intended for one order can affect another service’s next renewal.
In this guide
A practical checklist
Obtain the issuer’s actual CAA requirement
Ask which CAA identifier the selected authority requires. A reseller’s shop domain is not necessarily the issuer’s identifier. Confirm wildcard requirements and any issuer-specific account or validation restrictions.
Inspect the effective DNS policy
Check the requested name, relevant parent records and alias behaviour using the issuer’s diagnostic guidance. Look for existing issue and issuewild entries. Do not assume the DNS panel currently open is authoritative for the domain.
Distinguish a policy refusal from a DNS failure
A restrictive CAA answer is different from SERVFAIL, broken DNSSEC or an unresponsive nameserver. Capture the exact issuer error and DNS response. Altering authorization does not repair an underlying DNS outage.
Make the smallest approved change
Have the DNS owner add or correct the necessary authorization while preserving other legitimate issuers. Review the final record values before saving. Do not copy a sample identifier without confirming the authority and service.
Recheck and retain a policy record
Allow for DNS caching and ask the issuer to retry. Record why each authorized issuer is present and which service uses it. Revisit this list when changing hosting, CDN or certificate supplier.
Common problems and decisions
Wildcard issuance is blocked
Check whether an issuewild policy applies and whether it permits the intended issuer. Successful non-wildcard issuance does not prove that the wildcard policy is correct.
The challenge passes but issuance remains pending
Domain control and CAA are separate checks. Ask the issuer to identify the remaining failure rather than changing a successful challenge repeatedly.
The current certificate still works
CAA affects issuance decisions. Existing HTTPS can continue to work while a future renewal is blocked, so test authorization before the renewal deadline.
Prepare for the next conversation
Send the support team the requested hostname, issuer, exact error and a redacted DNS policy snapshot. Avoid publishing internal change records or account identifiers. For a shared government or business domain, agree changes with the authorized DNS team and document the other renewal systems that rely on the policy.
Continue with the right guide or service
Common questions
Do I need CAA to get SSL?
CAA is not universally mandatory for a domain owner. If a relevant CAA policy exists, the issuer must evaluate it; DNS errors can also prevent that check.
Does CAA prove domain ownership?
No. It authorizes issuers. The certificate request still needs the applicable domain control validation.
Should I authorize every certificate authority?
Base the policy on the services you actually use. Broadening it without a reason removes much of the restriction’s purpose.
Will a CAA change revoke my existing certificate?
CAA is an issuance control, not a revocation mechanism. Contact the issuer separately if an existing certificate must be revoked.