Traditional CDN Failed to Deploy Due to SSL Validation (CAA Error)

If you’re using Staq’s Traditional CDN and encounter an error during deployment, such as the one below, it typically points to a domain validation issue during the SSL certificate setup step:

Error: The domain ownership DNS validation has failed (FAILED). You must revoke the SSL certificate and start the validation process again.

What Caused This Error?

This issue is caused by a DNS-level restriction known as a CAA (Certificate Authority Authorization) record. A CAA record explicitly controls which certificate authorities (CAs) are permitted to issue SSL certificates for your domain.

If your domain’s DNS has a CAA record that does not allow Amazon as a valid certificate authority, AWS will fail to validate domain ownership and abort the certificate issuance process required for the CDN deployment.

How to Fix It

To allow the Traditional CDN to issue an SSL certificate through AWS, follow these steps:

1. Login to your domain’s DNS provider (e.g. Cloudflare, Staq DNS, GoDaddy).
2. Check for existing CAA records in the DNS zone.
3. If any CAA record exists, add an additional CAA entry which includes "amazonaws.com" for Amazon

This grants AWS (Amazon Certificate Manager) permission to issue SSL certificates for your domain.

Example: If you previously had this CAA record only:

0 issue "letsencrypt.org"

You’ll need to modify your DNS and include both:

0 issue "letsencrypt.org"
0 issue "amazonaws.com"

Once You’ve Updated the DNS

• Wait for DNS propagation (usually up to 15 minutes).
• Return to the site’s Staq Panel and re-initiate the CDN deployment process.

Once the CAA policy permits Amazon, the domain ownership check should succeed and the deployment will proceed through the CloudFront and Deployment stages as expected.