CAA Violation: Certificate Not Authorized
CAA (Certificate Authority Authorization) violation — the domain's DNS CAA record does not permit the specified CA to issue a cert. Let's Encrypt, DigiCert and others check CAA before issuance. If CAA says "only digicert.com" and you request from Let's Encrypt — refuse. Fix: add the CA to CAA or remove the CAA record.
Below: causes, fixes, FAQ.
Common Causes
- DNS CAA permits only a specific CA (e.g. digicert.com) while you use Let's Encrypt
- CAA wildcard (
issuewild) does not authorise CA for wildcard certs - iodef CAA with a wrong email — CA can't notify
- CAA with
;in value — syntax error, effectively "no CA allowed" - Propagation not complete — stale CAA still cached
Step-by-Step Fix
- Check current CAA: Enterno DNS → CAA type
- Add the CA to CAA:
example.com. IN CAA 0 issue "letsencrypt.org" - For wildcards:
example.com. IN CAA 0 issuewild "letsencrypt.org" - Full example: CAA research
- Wait 24h after CAA update (propagation)
Related SSL Errors
Why teams trust us
How it works
Enter domain
TLS chain verified
Expiry date & vulnerabilities
What Does the SSL Check Cover?
SSL/TLS is the encryption protocol that protects data between the browser and server. Our tool analyzes the certificate, chain of trust, TLS version, and knownvulnerabilities.
Certificate Details
Issuer, validity period, signature algorithm, covered domains (SAN), and validation type (DV/OV/EV).
Chain of Trust
Full chain verification: from leaf certificate through intermediates to root CA.
TLS Analysis
Protocol version (TLS 1.2/1.3), cipher suites, Perfect Forward Secrecy (PFS) support.
Expiry Alerts
Set up a monitor — get Telegram and email alerts 30/14/7 days before expiration.
DV vs OV vs EV Certificates
- Confirms domain ownership only
- Issued in minutes automatically
- Free via Let's Encrypt
- Suitable for most websites
- Most common certificate type
- Organization (OV) or Extended Validation (EV)
- Issued in 1-5 business days
- Costs $50 to $500/year
- For finance, e-commerce, government sites
- Increases user trust
Who uses this
DevOps
SSL certificate monitoring
Security
TLS config audit
SEO
HTTPS as ranking factor
E-commerce
customer trust
Common Mistakes
www and subdomains.Best Practices
Strict-Transport-Security header forces browsers to always use HTTPS.Get more with a free account
SSL certificate monitoring, check history and alerts 30 days before expiry.
Sign up freeLearn more
Frequently Asked Questions
I don't need CAA — what now?
Remove all CAA records. Any CA may issue. CAA is optional — no constraints by default.
Who checks CAA?
The CA before issuance (mandatory for public CAs since 2017). Browsers do not check CAA.
Is iodef CAA mandatory?
No. iodef is an email for notifications on mis-issuance attempts. Useful but optional.
How to check CAA?
<a href="/en/dns">Enterno DNS</a> → CAA type. Or <code>dig CAA example.com</code>.