Please fill out the fields below so we can help you better. Note: you must provide your domain name to get help. Domain names for issued certificates are all made public in Certificate Transparency logs (e.g. https://crt.sh/?q=example.com), so withholding your domain name here does not increase secrecy, but only makes it harder for us to provide help.
Well, I'm not sure where that message is coming from exactly (as I'm not that familiar with Akamai). But I can try to explain it a bit: If your domain name gives a SERVFAIL when the CAA record is requested, then Certificate Authorities can't validate whether they're allowed to issue for your name. You don't need to have a CAA record, but the DNS server needs to say so rather than returning an error.
I tried to look at your domain with DNSViz, but there are so many CNAMEs and bad delegations that I'm not sure I can make sense of it. You need to make sure your glue records and delegations are correct before worrying about certificates at all.
akamaiedge.net to dsca.akamaiedge.net: The glue address(es) for n2dsca.akamaiedge.net (23.203.167.24, 23.203.167.92) differed from its authoritative address(es) (23.203.167.24). See RFC 1034, Sec. 4.2.2.
akamaiedge.net to dsca.akamaiedge.net: The glue address(es) for n4dsca.akamaiedge.net (23.203.167.24, 23.203.167.92) differed from its authoritative address(es) (23.203.167.24). See RFC 1034, Sec. 4.2.2.
net to akamaiedge.net: The following NS name(s) were found in the authoritative NS RRset, but not in the delegation NS RRset (i.e., in the net zone): a11-192.akamaiedge.net, ns5-194.akamaiedge.net, a13-192.akamaiedge.net, ns6-194.akamaiedge.net, ns7-194.akamaiedge.net See RFC 1034, Sec. 4.2.2.
net to edgekey.net: The following NS name(s) were found in the authoritative NS RRset, but not in the delegation NS RRset (i.e., in the net zone): adns1.akam.net, a11-65.akam.net, a13-65.akam.net, a3-65.akam.net, ns1-2.akam.net, a9-65.akam.net, usw6.akam.net, a5-65.akam.net See RFC 1034, Sec. 4.2.2.
net to edgekey.net: The following NS name(s) were found in the delegation NS RRset (i.e., in the net zone), but not in the authoritative NS RRset: a1-66.akam.net, a10-66.akam.net, a7-64.akam.net See RFC 1034, Sec. 4.2.2.
People who post here are random strangers on the Internet who happen to be taking the time to respond to posts. If you need something on a priority basis, you might want to look more toward whomever you're paying or hiring for support. Though people here try to be helpful (and generally are), they might not work on your timeline.
Domain is hosted on akamai and CPS is not being able to new the certificate
"detail": "Error finalizing order :: rechecking caa: While processing CAA for preprod.aecloud.io: DNS problem: SERVFAIL looking up CAA for preprod.aecloud.io - the domain's nameservers may be malfunctioning",
"status": 403,
"identifier": {
"type": "dns",
"value": "preprod.aecloud.io"
This means what it says. You need to work with whomever runs your DNS servers to have them configured correctly to serve your domain. (Not just to get a certificate, but in order for your domain name to work reliably at all.)
we are using Azure DNS which a global service and other domain are working fine which mapped to that dns, but let's encrypt is not able to issue the crt to this domain which is hosted on akamai.
@rakeshk, that maybe true. But I suggest checking it for yourself as well.
The Authoritative Name Severs seem to be ns1-08.azure-dns.com. ns2-08.azure-dns.net. ns3-08.azure-dns.org. ns4-08.azure-dns.info. for the domain aecloud.io.
So my script checks each of the Alternative names (i.e. SANs) on each of those name servers.
The results are attached, I only skimmed it. But you should check in detail, as each name on the Certificate needs to have the NS respond properly.
Here is a script I quickly through together to check.
but here i did not see any problem with aecloud.io [this only we have on azure ] remaining tekioncloud.com or xyz are on route53, if we are checking this againg azure dns it is expected.
this is logs shared by akamai team can you check this
{
"type": "urn:ietf:params:acme:error:caa",
"detail": "Error finalizing order :: rechecking caa: While processing CAA for gmc-dev-beta.aecloud.io: DNS problem: SERVFAIL looking up CAA for aecloud.io - the domain's nameservers may be malfunctioning",
"status": 403,
"identifier": {
"type": "dns",
"value": "gmc-dev-beta.aecloud.io"
}
},
{
"type": "urn:ietf:params:acme:error:caa",
"detail": "Error finalizing order :: rechecking caa: While processing CAA for dealer-stage.aecloud.io: DNS problem: SERVFAIL looking up CAA for dealer-stage.aecloud.io - the domain's nameservers may be malfunctioning",
"status": 403,
"identifier": {
"type": "dns",
"value": "dealer-stage.aecloud.io"
}
},
{
"type": "urn:ietf:params:acme:error:caa",
"detail": "Error finalizing order :: rechecking caa: While processing CAA for gm-dev.aecloud.io: DNS problem: SERVFAIL looking up CAA for gm-dev.aecloud.io - the domain's nameservers may be malfunctioning",
"status": 403,
"identifier": {
"type": "dns",
"value": "gm-dev.aecloud.io"
}
I don't personally have more information to help you, and as I said earlier I don't work for Let's Encrypt but am just a person who occasionally posts on here. I've rerun the DNSViz analysis and it still reports warnings that glue records and DNS delegations are inconsistent.
I don't really have any more information than that, and I don't have the time to try to dig in DNS server by DNS server to try to help further.