CAA Violation: Certificate Not Authorized

• DNS CAA permits only a specific CA (e.g. digicert.com) while you use Let's Encrypt
• CAA wildcard (issuewild) does not authorise CA for wildcard certs
• iodef CAA with a wrong email — CA can't notify
• CAA with ; in value — syntax error, effectively "no CA allowed"
• Propagation not complete — stale CAA still cached

1. Check current CAA: Enterno DNS → CAA type
2. Add the CA to CAA: example.com. IN CAA 0 issue "letsencrypt.org"
3. For wildcards: example.com. IN CAA 0 issuewild "letsencrypt.org"
4. Full example: CAA research
5. Wait 24h after CAA update (propagation)

Check SSL Certificate →

• ERR_SSL_PROTOCOL_ERROR
• NET::ERR_CERT_AUTHORITY_INVALID
• SSL Handshake Failed
• All SSL errors

The CAA Violation Error occurs when a Certificate Authority (CA) issues a certificate for a domain without proper authorization, violating the Certificate Authority Authorization (CAA) DNS record. To resolve this, ensure that your domain's CAA records explicitly list the CA you intend to use. Use the command dig CAA yourdomain.com to check your current CAA records.

The CAA Violation Error arises when a certificate is issued for a domain without the necessary permissions defined in the domain's CAA records. CAA records are a DNS resource record that allows domain owners to specify which Certificate Authorities are permitted to issue certificates for their domain. This mechanism enhances security by preventing unauthorized issuance of SSL/TLS certificates.

When a Certificate Authority receives a request for a certificate, it checks the CAA records for that domain. If the CA is not listed in the records, it will reject the request, leading to the CAA Violation Error. This can manifest in various ways, including browser warnings or SSL handshake failures.

For example, if your domain example.com has a CAA record that only allows letsencrypt.org to issue certificates, any request to issue a certificate from digicert.com will trigger a CAA Violation Error. The specific DNS record might look like this:

example.com. 3600 IN CAA 0 issue "letsencrypt.org"

In this case, the CA must be listed in the CAA record for the certificate to be authorized.

To resolve a CAA Violation Error, you need to ensure that your CAA records are configured correctly. Follow these steps:

1. Check Your Current CAA Records: Use the following command to check your CAA records:

dig CAA yourdomain.com

This command will return the current CAA records for your domain. Look for records that specify which CAs are authorized to issue certificates.

1. Modify Your CAA Records: If the CA you wish to use is not listed, you will need to add it. This is done at your domain registrar's DNS management interface. For example, to allow digicert.com and letsencrypt.org to issue certificates, your CAA record should look like this:

example.com. 3600 IN CAA 0 issue "letsencrypt.org"
example.com. 3600 IN CAA 0 issue "digicert.com"

Note: You can specify multiple CAs by adding additional CAA records. Make sure to follow the correct syntax as per your DNS provider's requirements.

1. Verify the Changes: After updating your CAA records, wait for the DNS changes to propagate (this can take up to 48 hours) and then recheck with the dig command. Ensure that your desired CA is listed correctly.

Once the correct CAA records are in place, you can attempt to reissue the SSL certificate. If the CAA records are configured correctly, the Certificate Authority should issue the certificate without triggering the CAA Violation Error.

In conclusion, the CAA Violation Error is an important security feature that helps prevent unauthorized certificate issuance. By ensuring that your CAA records are accurate and up-to-date, you can avoid this error and maintain a secure web presence.