CAA Records and Certificate Renewal
What Are CAA Records?
CAA (Certificate Authority Authorization) records are DNS records that specify which certificate authorities (CAs) are allowed to issue SSL certificates for your domain. If a CAA record is present and does not include the CA that the WAF uses, certificate issuance and renewal will fail.
How CAA Records Affect the WAF
The WAF uses GoDaddy/Starfield as the certificate authority for SSL certificates. When your domain has CAA records that restrict certificate issuance to other CAs (such as Let’s Encrypt or DigiCert only), the WAF cannot issue or renew your certificate.
This commonly results in:
- Certificate renewal failures with a “Renewal not allowed” error
- Emails from Sucuri/GoDaddy about failed certificate requests
- Your site showing an expired or invalid certificate
How to Fix It
Add CAA records for all three certificate authorities to your domain’s DNS configuration. Sectigo issues the initial (bridge) certificate when your WAF is first set up, and GoDaddy/Starfield issue the renewal certificates, so all three need to be authorized:
CAA Records to Add:
| Type | Name | Flag | Tag | Value |
|---|---|---|---|---|
| CAA | @ (or your domain name) |
0 | issue | sectigo.com |
| CAA | @ |
0 | issue | godaddy.com |
| CAA | @ |
0 | issue | starfieldtech.com |
If you also use wildcard certificates, add a matching issuewild record for each:
| Type | Name | Flag | Tag | Value |
|---|---|---|---|---|
| CAA | @ |
0 | issuewild | sectigo.com |
| CAA | @ |
0 | issuewild | godaddy.com |
| CAA | @ |
0 | issuewild | starfieldtech.com |
You do not need to remove your existing CAA records for other CAs. Multiple CAA records can coexist - simply add these entries alongside your existing ones.
Verifying Your CAA Records
You can check your current CAA records with DNS is Beautiful’s CAA lookup.
You should see sectigo.com, godaddy.com, and starfieldtech.com listed among the results.
After Updating CAA Records
Once you have added the CAA record, please contact us at support@expeditedsecurity.com and we will re-trigger the certificate renewal process. Changes to DNS records can take up to 24 hours to propagate.
API Help
We’re happy to help you with certificate renewal issues. Please don’t hesitate to:
- Contact us at support@expeditedsecurity.com
- Book a Call at https://app.harmonizely.com/expedited/30-min