CAA records for automatically issued certificates

Some UpCloud services obtain SSL/TLS certificates for your domain automatically:

• Managed Load Balancer dynamic certificates
• Managed Object Storage custom domains
• Managed Kubernetes services exposed over HTTPS through a Load Balancer

These certificates are issued by ZeroSSL, whose certificates are signed by Sectigo. Before issuing a certificate, the certificate authority checks your domain's CAA (Certification Authority Authorization) records, which list the authorities allowed to issue certificates for it.

If your domain has no CAA records, no action is needed.

Check your domain

Run the following command, replacing example.com with your domain:

dig example.com CAA +short

If it returns nothing, your domain has no CAA records and you can skip the rest of this guide. If it returns records and none of them contain sectigo.com, certificates cannot be issued until you add the records below.

Add the CAA records

Add a CAA record with the following values at your zone root (for example, example.com):

If your DNS provider takes the record as a single value instead of separate fields, enter 0 issue "sectigo.com".

This record also covers wildcard certificates, such as the *.obj name used by Managed Object Storage custom domains. If your domain already has issuewild records, they take precedence for wildcard certificates, so also add a second record with the same values but the tag issuewild.

• Add the record alongside your existing CAA records, such as letsencrypt.org, rather than replacing them.
• Enter the value as sectigo.com, without a trailing dot. A value of sectigo.com. does not allow Sectigo to issue certificates.
• The record must be at the zone root, or on a parent name of your hostname that is not a CNAME. The hostname you use with UpCloud is usually a CNAME, which cannot hold other record types, so the certificate authority checks its parent names instead.

Recognize a CAA issue

If your CAA records do not allow sectigo.com, the certificate request fails about 10 to 15 minutes after it starts, even when the DNS records for your service are correct:

• Managed Load Balancer and Managed Kubernetes: the dynamic certificate bundle shows a failed state. If you added a hostname to a bundle that already has a certificate, the existing certificate stays in use but does not cover the new hostname.
• Managed Object Storage: the custom domain shows a failed status, and the Control Panel shows an alert about failed domain verification. The DNS verification when you add a custom domain checks the CNAME records only, so it can succeed even when CAA records block the certificate.

If you see these signs and your DNS records are correct, check your CAA records as described in Check your domain.

After you add the records

You do not need to recreate the certificate bundle or custom domain. UpCloud retries automatically, and the certificate is issued at the next attempt, usually within ten minutes.