Consistent 500's for new-cert (failing CAA for one domain)

[cpu]

@rcc13

Note that unlike “www.merchantcapitalsource.com”, “merchantcapitalsource.com” is not an alias. In other word, we should not have to look up CAA records for “sitelockcdn.net” that results in a SERVFAIL.

Your reading of the RFC seems to be describing the tree climb as I understand erratum 5065 describes it, not as the legacy CAA interpretation of the base RFC describes.