• Hi, Pleskians! We are running a UX testing of our upcoming product intended for server management and monitoring.
    We would like to invite you to have a call with us and have some fun checking our prototype. The agenda is pretty simple - we bring new design and some scenarios that you need to walk through and succeed. We will be watching and taking insights for further development of the design.
    If you would like to participate, please use this link to book a meeting. We will sent the link to the clickable prototype at the meeting.
  • Our UX team believes in the in the power of direct feedback and would like to invite you to participate in interviews, tests, and surveys.
    To stay in the loop and never miss an opportunity to share your thoughts, please subscribe to our UX research program. If you were previously part of the Plesk UX research program, please re-subscribe to continue receiving our invitations.
  • The Horde webmail has been deprecated. Its complete removal is scheduled for April 2025. For details and recommended actions, see the Feature and Deprecation Plan.

Resolved Let's Encrypt: Domain validation failed, but CAA records are correct

Wyrix

New Pleskian
I'm using the Let's Encrypt extension in Plesk Obsidian. With this extension, I'm trying to request a wildcard certificate, but it returns;
Domain validation failed for <domain>: Invalid response from <url>.
Type: urn:ietf:params:acme:error:caa
Status: 403
Detail: CAA record for <domain> prevents issuance

My DNS records are;
<domain>. CAA (issuewild) letsencrypt.org
<domain>. CAA (issue) ;
<domain>. CAA (iodef) mailto:<email>

Does somebody have an idea what's going wrong here? The logs aren't helping me.
 
It turns out that if you have a single domain certificate on a domain and want to change it to a wildcard certificate, you sometimes must have the issue CAA record set to 'letsencrypt.org'.

In my case, I'm changing all domains from single domain certificates to wildcard certificates and in 2 out of 30 domains, the issue CAA record was needed.
 
It turns out that if you have a single domain certificate on a domain and want to change it to a wildcard certificate, you sometimes must have the issue CAA record set to 'letsencrypt.org'.

In my case, I'm changing all domains from single domain certificates to wildcard certificates and in 2 out of 30 domains, the issue CAA record was needed.
You should mark it as solved then? Just to keep things clean in the beginning. We all browse eagerly Obsidian forum these days :)
 
Back
Top