If you encounter the error: “Certificate validation failed (CAA_error)”
it means your domain’s DNS settings are preventing Amazon (AWS) from issuing the SSL certificate required for DeskDay Branding.
What are CAA Records?
CAA (Certification Authority Authorization) records are DNS settings that control which providers can issue SSL certificates for your domain.
If Amazon is not allowed in your CAA records, the SSL certificate cannot be issued, resulting in this error.
📋 DNS Fields (Same Across All Providers)
No matter where your domain is hosted (like GoDaddy, Cloudflare, Amazon Route 53, Namecheap), you’ll see similar fields:
Field | What to Enter | Notes |
Type | CAA | Select CAA from the record type dropdown |
Name / Host | @ or your subdomain | Use @ for root domain, or enter the subdomain (e.g. app) |
Tag | issue or issuewild | You will add two records — one for each tag |
Value / CA Domain | amazon.com | This authorizes Amazon to issue certificates |
TTL | 3600 (or Auto) | Time To Live — 3600 seconds (1 hour) is standard |
✅ Required CAA Records
You must add both of these records:
Type | Name | Tag | Value | TTL |
CAA | @ or subdomain | issue | amazon.com | 3600 |
CAA | @ or subdomain | issuewild | amazon.com | 3600 |
👉 issue = allows normal SSL certificates
👉 issuewild = allows wildcard certificates (e.g. *.yourdomain.com)
⚠️ GoDaddy Users (Important)
If you're using GoDaddy, you’ll see an extra field:
Flag = 0 → ✅ Use this (standard)
Flag = 128 → ❌ Not required
Always set Flag = 0
🛠 Step-by-Step Setup
Step 1: Log in
Go to your DNS provider (GoDaddy, Cloudflare, Route 53,Namecheap etc.)
Sign in and open your domain
Step 2: Open DNS Settings
Find DNS / Manage DNS
View your existing records
Step 3: Add First Record (issue)
Type: CAA
Name:
@(or subdomain likeapp)Tag:
issueValue:
amazon.comTTL: 3600 or Auto
Flag (if shown): 0
Save
Step 4: Add Second Record (issuewild)
Same as above, but:
Tag:
issuewildSave
⏳ Step 5: Wait for DNS Propagation
Usually takes 5–15 minutes
May take up to 1 hour
🔍 Step 6: Verify (Optional but Recommended)
Check your records using:
👉 https://dnschecker.org
Select CAA record type
Enter your domain
You should see:
issue → amazon.comissuewild → amazon.com
🔁 Step 7: Complete DeskDay Branding
Return to DeskDay Branding setup
Enter:
Customer Portal name
Company Portal name
Submit again
Once DNS is updated, the SSL certificate will be issued successfully ✅
❗ Important Notes
Do NOT remove existing CAA records (like
letsencrypt.org)Multiple CAA records can coexist without issues
Just add Amazon alongside existing ones
💬 Still Facing Issues?
If the error persists after 1 hour: Please contact DeskDay Support