Hi, i’m having issues creating a certificate for an azure virtual machine using the Win-Acme-client (wacs). I’m using wacs in unattended mode and this worked for different vms (with different hostnames) till this morning. Domain: rd-2018960013-hsdss-dev-jb.westeurope.cloudapp.azure.com I ran thi…

Oh - I see: Microsoft has removed all CAA entries. A check, some minutes old - https://check-your-website.server-daten.de/?q=qa-helloflex.westeurope.cloudapp.azure.com#caa 13. CAA - Entries Domainname flag Name Value ∑ Queries ∑ Timeout qa-helloflex.westeurope.cloudapp.azure.com 0 no CAA …

Hi @jonben [image] jonben: Domain: rd-2018960013-hsdss-dev-jb.westeurope.cloudapp.azure.com you can't create a certificate with that domain name. See your check - rd-2018960013-hsdss-dev-jb.westeurope.cloudapp.azure.com - Make your website better - DNS, redirects, mixed content, certificate…

Hi, We have a similar issue with our domain which was working previously. This used to work previously. xyz.australiaeast.cloudapp.azure.com Now our certificates are not renewing or not able to create a new one. We are getting CAA record for xyz.australiaeast.cloudapp.azure.com prevents issuance …

Hi @JuergenAuer Thank you for your response. This seems strange, the same certificate creation process worked yesterday. Just for my unterstanding: This is something i can’t do anything about, because Microsoft set these CAA records for azure.com ? I think it isn’t possible for me to set CAA entr…

[image] jonben: This seems strange, the same certificate creation process worked yesterday. If Microsoft has changed the CAA entries yesterday / today, now it doesn't work. That's how CAA RR defined. [image] jonben: This is something i can’t do anything about, because Microsoft set these…

The same with *.westeurope.cloudapp.azure.com. Our one AKS cluster is working using certificate issued by Let`s Encrypt 3 days ago. But another one, created few hours ago, can’t get one. Didn’t find any announcement from Microsoft about coming changes…

I’ve edited the topic title. There are a lot of users with the same problem.

[image] helgart: The same with *.westeurope.cloudapp.azure.com That's expected. A blocking CAA on azure.com blocks all subdomains.

I have posted a question to MS about this today, lets see if we can get anything out of them, this has come at a really bad time for us we really need this to be working for our deployments. MS Link

I see a referer in “check-your-website” - from a servicedesk - microsoft site. To one of these azure subdomain checks. Looks like Microsoft checks that.

Works like a charm now, thanks for checking this out for me!

All azure.com - subdomains are blocked creating Letsencrypt-certificates - Urn:ietf:params:acme:error.caa. Upd 15:30 Microsoft has removed all CAA - #15 by JuergenAuer - Help

Topic		Replies	Views	Activity
CAA record prevents issuance Help	2	1411	July 19, 2020
CAA behaviour changed? Help	23	5775	March 11, 2019
Error while creating certificate with win-acme: "CAA record for <site> prevents issuance" Help	2	906	August 13, 2020
CAA error when creating certificate Help	9	1206	June 9, 2024
CAA record prevents issuance Help	6	4265	February 23, 2020