Add a CAA record that names your certificate authority on Cloudflare
Why it matters
A CAA record lists which certificate authorities may issue certificates for your domain, so a wrongly issued certificate is harder to obtain. Without one, any authority may issue.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- Open DNS then Records and choose Add record. Select type CAA, enter the domain name (or @), flags 0, and choose the tag that allows specific hostnames (issue). Enter the CA's domain, for example letsencrypt.org, and save. Repeat for each CA.
- Once the zone has any CAA record, Cloudflare adds records for its Universal SSL CAs (Google Trust Services, Let's Encrypt, SSL.com and Sectigo). They are not shown in the dashboard, so check with dig CAA example.com +short. Advanced Certificate Manager certificates are not covered, so add their CA yourself.
- If you buy certificates elsewhere or have your own ACME client at the origin, add that CA as well.
The examples use example.com. Replace it with your own domain.
Related
Scan your domain to see whether this applies to you.