Symptoms
An attempt to issue a Let's Encrypt certificate in Plesk fails with the following error:
Invalid response from https://acme-v02.api.letsencrypt.org/acme/finalize/170110130/120505529288.
Details:
Type: urn:ietf:params:acme:error:caa
Status: 403Detail: Error finalizing order :: While processing CAA for example.com: DNS problem: SERVFAIL looking up CAA for example.com - the domain's nameservers may be malfunctioning
External DNS service is being used to host the domain DNS Zone.
Cause
External DNS server does not process CAA requests correctly and SERVFAIL is returned instead of NOERROR.
Resolution
- Contact DNS server administrator to address the issue.
As workaround:
Add a
CAArecord like below example into the externally hosted domain DNS zone:example.com. CAA 0 issue "letsencrypt.org"
