I'm trying to create a new cert in my AWS instance for a test domain test.wordle.starwars.guide
. My domain is hosted with Namecheap.com
According to Google's Toolbox, I have the CAA record, see https://toolbox.googleapps.com/apps/dig/#CAA/*.test.wordle.starwars.guide. This link Namecheap provided to me showing it's working. Should I be using it with the *.
at this start?
When attempting to create a new cert for test.wordle.starwars.guide
, after I add the CNAME validation to the domain, it will show Successful
under the domain list, then a few seconds later it switches to Failed
and the Status of the certificate goes to `Failed. Play by play screenshots below.
What am I missing here?
Come to find out, a CNAME record (wordle.starwars.guide to davidlozzi.github.io) inherits the CAA records from it's target. So my domain was showing github's CAA records. The fix is to delete the CNAME, request the cert, then put the CNAME back. I can do that for my test domain, but wordle.starwars.guide is live in production, can't go deleting. After some further brainstorming, I realized I can get the wildcard cert on AWS, *.starwars.guide, and then I simply used that for all of my domains.
You only need to specify the CAA record on the domain name. It's not required for subdomains.
Besides that, I have noticed Certificate Manager sometimes being annoying if I did not add al 4 AWS CAA values.
0 issue "amazontrust.com"
0 issue "amazon.com"
0 issue "amazonaws.com"
0 issue "awstrust.com"
Try adding all of them to starwars.guide and try again.