Skip to content
GRIN Classic Help Center home
InboxAsk a human

Your white-label domain SSL certificate keeps failing: check your CAA records

Updated by Michel from GRIN

Summary

This article explains why a white-label domain SSL certificate can fail immediately even when your DNS records are correct, and how to fix it by adjusting your CAA records.

Description

You added the DNS records for your white-label domain, but the SSL certificate keeps failing right away, and the branded domain will not load securely.

Steps

  1. Check whether your domain publishes CAA records, using a public DNS lookup tool to query the CAA record type for your domain.
  2. If CAA records exist and do not list Amazon, the certificate cannot be issued, because GRIN issues your white-label certificate through Amazon.
  3. Fix it at your DNS provider in one of two ways. Add a single record, type CAA, host your root domain, flags 0, tag issue, value amazon.com, which keeps your other certificate authorities intact. Or remove all CAA records for the domain, which lets any authority issue.
  4. Amazon accepts any of these values in the CAA record: amazon.com, amazontrust.com, awstrust.com, amazonaws.com. A related authority such as Starfield is not accepted for this check.
  5. Wait for the change to propagate, usually about 15 minutes, then let GRIN know so the certificate can be re-issued and attached to your branded domain.

Why this happens

A CAA record is a DNS setting that lists which certificate authorities may issue certificates for your domain. If the list does not include Amazon, Amazon is blocked from issuing your white-label certificate, so it fails immediately even though the rest of your DNS is correct. Adding Amazon to the list, or removing the restriction, unblocks the issuance.

Related