Error enabling custom https on CDN custom domain

user_592674 0
Viewed 170

When enabling Custom HTTPS on our Custom Domain on our Azure CDN, I get the following error:

(BadRequest) We found a CAA record for your custom domain that does not include DigiCert as an authorized Certificate Authority so we cannot have DigiCert generate a certificate for you. Either consider adding "issue" "digicert.com" to your CAA records or remove all CAA records from your domains DNS zone.

This occurs via the CLI (az cdn custom-domain enable-https) and through the web portal.

We have digicert set up as an appropriate CAA record through Cloudflare:

dig +short CAA mydomain.ca | sort
0 iodef "mailto:caa@mydomain.ca"
0 issue "comodoca.com"
0 issue "digicert.com; cansignhttpexchanges=yes"
0 issue "letsencrypt.org"
0 issuewild "comodoca.com"
0 issuewild "digicert.com; cansignhttpexchanges=yes"
0 issuewild "letsencrypt.org"

Could the existence of ; cansignhttpexchanges=yes be the cause of the issues? This worked fine in our development environment a few weeks ago, and is on the same domain.

azure-cdn azure https
2 Answers

As this WAS working for app services, we ended up opening a ticket with MS and they resolved the issue on their side. We are now able to provision as necessary.

user_5926740
user_7481290
Related