Existing CAA records on your domain might prevent Certificate Manager from issuing certificates for your domain. You should ensure that there is a CAA record for pki.goog to allow Google to issue certificates for your authorized domains.

October 18, 2022 - I ran this command : sudo certbot certonly \ --manual --preferred-challenges "dns-01" --server "https://dv-sxg.acme-v02.api.pki.goog/directory" --domains "example.com" Output : Saving debug log to /var/log/letsencrypt/letsencrypt.log Requesting a certificate for example.com Please deploy a DNS TXT record under the name: _acme-challenge.example.com. with the following value: 12345gsfafaf1231243sfdbsgfdg452fds Before continuing, verify the TXT record has been deployed.

October 4, 2025 - What is the name of the domain? roaspy.com What is the error message? CAA records block issuance. Please remove all CAA records or add records for this authority (pki.goog) What is the issue you’re encountering CAA rec…

If your only letsencrypt.org or pki.goog CAA record contains the issuewild tag, we will not be able to issue a certificate on your behalf. Use https://crt.sh/ to query whether some other web server has also been generating certs for your domain.

For certificates issued prior to July 1, 2021, CAA checking is optional if the CA or an Affiliate of the CA is the DNS Operator (as defined in RFC 7719) of the domain’s DNS. CAs are permitted to treat a record lookup failure as permission to issue if:

July 16, 2026 - If you use CAA records to control who can issue SSL certificates on your domain, you must allow Google Domains to issue a certificate before you can use a Secureframe Trust custom domain. Add a CAA record for pki.goog alongside your existing records.

September 26, 2024 - Tried adding a random CAA as cloudflare docs tell me with any CAA record pki.goog should also be added if Universal SSL is enabled. ... Instead of the gitbook error I have shown my DNS records instead. Docs I read: Add CAA records · Cloudflare SSL/TLS docs ... This is what I’m referring to in the documentation.

Google services' certificates can be issued by any of the Certificate Authority from this regularly updated list. Applications connecting to Google services should trust all the Certificate Authorities from that list. Beware that some tools do not support working with a PEM file that contains ...

September 18, 2025 - What is the name of the domain? qjyg.de What is the error message? CAA records block issuance. Please remove all CAA records or add records for this authority (pki.goog) What is the issue you’re encountering The automa…

Certificate Authority Authorization (CAA) records must permit pki.goog to issue certificates for your domain.

February 16, 2025 - What is the name of the domain? maximportal-dot-com What is the error message? A DNS CAA record exists for domain(s) maximportal.com which forbids the issuance of this certificate What is the issue you’re encountering Cannot create new cert in Godaddy due to CAA record in Cloudflare What ...

March 29, 2022 - I’ve noticed on my domains it seems like Cloudflare is using a new CAA called pki.goog. I use Universal SSL on all my domains. The article https://support.cloudflare.com/hc/en-us/articles/115000310832-Certification-Authority-Authorization-CAA-FAQ states The following DNS records are automatically set if you continue to use Cloudflare’s free Universal SSL certificates: example.com.

The absence of a record means any CA can issue. The most surprising part is how permissive the default is: if there are no CAA records for a domain, then any CA on the internet is authorized to issue certificates for it.

October 16, 2025 - If your root domain uses CAA records, you'll need to add new records to allow us to issue certificates for the custom domain on your behalf. ... # CAA records added by DigiCert 0 issue "digicert.com; cansignhttpexchanges=yes" 0 issuewild "digicert.com; cansignhttpexchanges=yes" # CAA records ...

For certificates issued prior to July 1, 2021, CAA checking is optional if the CA or an Affiliate of the CA is the DNS Operator (as defined in RFC 7719) of the domain’s DNS. CAs are permitted to treat a record lookup failure as permission to issue if:

For certificates issued prior to July 1, 2021, CAA checking is optional if the CA or an Affiliate of the CA is the DNS Operator (as defined in RFC 7719) of the domain’s DNS. CAs are permitted to treat a record lookup failure as permission to issue if:

February 10, 2024 - SSL Validation encountered the following errors: CAA records block issuance. Please remove all CAA records or add records for this authority (pki.goog) I'm assuming that this is because my domain registrar (Vercel) has added a default CAA record on my domain which is automatically applied to all subdomains.

July 13, 2026 - Otherwise you will get a response similar to the image below, indicating you do have a CAA record configured and specifying the Certificate Authorities who are authorized for your domain: If your DNS provider supports CAA records, you can choose to set your preferred Certificate Authorities using CAA records. WP Engine does not require CAA records, however if you chose to configure CAA, be sure to include all of the records listed below. These multiple CAA records should be added so if the network SSL is updated by WP Engine, an SSL can be reissued without issue. 0 issue "letsencrypt.org" 0 issue "pki.goog; cansignhttpexchanges=yes" 0 issue "ssl.com" 0 issuewild "letsencrypt.org" 0 issuewild "pki.goog; cansignhttpexchanges=yes" 0 issuewild "ssl.com"

November 26, 2020 - The issue “;” flag means that no CA can issue certificates for this domain name. If your domain name has any CAA records set, SSL issuance from SSLs.com might be stuck after domain control validation is completed.