amazon-web-servicesssl-certificatenamecheapaws-certificate-manager

AWS Cert Manager errors "failed validation due to CAA error"


I'm trying to create a new cert in my AWS instance for a test domain test.wordle.starwars.guide. My domain is hosted with Namecheap.com

According to Google's Toolbox, I have the CAA record, see https://toolbox.googleapps.com/apps/dig/#CAA/*.test.wordle.starwars.guide. This link Namecheap provided to me showing it's working. Should I be using it with the *. at this start?

When attempting to create a new cert for test.wordle.starwars.guide, after I add the CNAME validation to the domain, it will show Successful under the domain list, then a few seconds later it switches to Failed and the Status of the certificate goes to `Failed. Play by play screenshots below.

What am I missing here?

My DNS CAA records in Namecheap

enter image description here

Successful Start

enter image description here

Then failed

enter image description here

UPDATE

Come to find out, a CNAME record (wordle.starwars.guide to davidlozzi.github.io) inherits the CAA records from it's target. So my domain was showing github's CAA records. The fix is to delete the CNAME, request the cert, then put the CNAME back. I can do that for my test domain, but wordle.starwars.guide is live in production, can't go deleting. After some further brainstorming, I realized I can get the wildcard cert on AWS, *.starwars.guide, and then I simply used that for all of my domains.


Solution

  • You only need to specify the CAA record on the domain name. It's not required for subdomains.

    Besides that, I have noticed Certificate Manager sometimes being annoying if I did not add al 4 AWS CAA values.

    0 issue "amazontrust.com"
    0 issue "amazon.com"
    0 issue "amazonaws.com"
    0 issue "awstrust.com"
    

    Try adding all of them to starwars.guide and try again.