When your WordPress site is using a free SSL certificate provided by Pressidium, certificate issuance and renewal happens automatically. This normally happens without any action required from you.
However, if your domain has CAA (Certificate Authority Authorization) DNS records in place, those records can prevent an SSL certificate from being issued or renewed if they do not allow the Certificate Authority (CA) used by our infrastructure. Pressidium uses two different Certificate Authorities depending on the network your site is provisioned: Let's Encrypt and Certainly. This article explains what CAA records are, how they can affect your WordPress site, how to check them, and how to configure them to allow both Let's Encrypt and Certainly to issue certificates.
What is a CAA record?
CAA is a type of DNS record that allows the owner of a domain to specify which Certificate Authorities are allowed to issue SSL/TLS certificates for that domain. Read up on our DNS introduction article if you need a refresh of what DNS is and how it works. For example:
example.com. CAA 0 issue "letsencrypt.org"
This tells Certificate Authorities that Let's Encrypt is authorized to issue certificates for the example.com domain. If you have CAA records and the Certificate Authority attempting to issue your certificate is not authorized, certificate issuance can fail. Let's Encrypt and other certificate authorities explicitly check CAA records as part of their certificate issuance process.
Why does this matter for your WordPress site
When you add or connect your website to the Pressidium platform and select to use a free SSL certificate, we try to verify your domain and automatically obtain (and at a later stage renew) an SSL certificate for your site. For example, when you add mywebsite.com via the Dashboard our platform may automatically request a certificate covering mywebsite.com and (depending on your selected preferences) www.mywebsite.com. If your DNS configuration contains a CAA policy that does not authorize the CA used by our platform, the certificate request may fail. Our platform will try to detect such cases and present the related warning in your Dashboard so you can try to update / add the proper CAA records.
How to check CAA records
The recommended approach is to review the DNS records in your DNS provider's control panel. Most panels provide a DNS record type filter so you can narrow down the DNS records list to quickly identify any CAA records.
Important: CAA policies follow the DNS hierarchy. Policies applied at the root / apex domain can apply to subdomains as well, and subdomains can have their own CAA policy that overrides the one from the parent / root domain. When working with a subdomain you should also review the CAA records of the parent domain.
Review CAA records using command line tools
You can use the `dig` command, available on most Linux and macOS systems to query CAA records directly:
dig +short CAA example.com
0 issue "letsencrypt.org"
0 issue "certainly.com"
You can also query a specific subdomain:
dig +short CAA www.example.com
If the command returns no CAA records for that hostname / subdomain, that does not necessarily mean that no CAA policy applies, since a CAA policy might be present on the parent hostname / domain.
You can also query a specific DNS resolver:
dig @1.1.1.1 +short CAA example.com
or:
dig @8.8.8.8 +short CAA example.com
This can be useful when troubleshooting DNS propagation or differences between DNS resolvers.
Review CAA records using online tools
You can use several online tools to query for CAA records:
Google Admin Toolbox (provides an online equivalent for the
digcommand).DNSChecker (use the record selection dropdown to query for CAA records).
DNSLabs (use the record selection filters to query for CAA records).
Which CAA records should I use?
Most of the time CAA records are not present so any certificate authority can issue an SSL certificate. If that's the case no further action is required on your part.
If there are existing records you need to carefully review them and ensure that the following records are present for the domain or subdomain you wish to add in our platform. Replace example.com with your actual subdomain or domain name:
example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issue "certainly.com"
After updating the DNS records, re-check the DNS status using dig or an online tool to verify that the records are actually in place / activated. Keep in mind that DNS changes can take time to propagate because of DNS caching and TTL values. An online tool may therefore temporarily show results that differ from another DNS resolver.
Notes & Considerations
Do not remove existing CAA records without first determining why they were added.
CAA records control certificate issuance, they do not install or renew certificates themselves.
DNS changes may not be visible immediately because of DNS caching and TTLs. Review the DNS status using the various tools to determine possible propagation issues.
Carefully review the full DNS hierarchy for CAA records when adding subdomains. CAA policies follow the DNS hierarchy and subdomains can have their own policy.
For domains added in the Pressidium platform ensure that both CA domains (letsencrypt.org and certainly.com) are present in the CAA policies.