问题描述
我使用 Window Server 2019 进行 DNS 管理。
我在 Aws 证书管理器 (ACM) 中为域 *.example.mydomain.hk
创建了公共 SSL 证书
之后,我添加了 SSL 证书的 DNS 配置。
下图来自网上。 我的设置:
Alias name: _66fxxxxxxxxx(auto generated after entering Full qualified domain name)
Full qualified domain name: _66fxxxxxxxxx.example.mydomain.hk
Fully qualified domain name for target host: _3ddxxxxxxxx.abcde.acm-validations.aws.
但是ACM出现错误,状态变为失败
The status of this certificate request is "Failed". One or more domain names have Failed validation due to a Certificate Authority Authentication (CAA) error.
当我 dig _66fxxxxxxxxx.example.mydomain.hk
时,它显示:
; <<>> DiG 9.10.6 <<>> _66fxxxxxxxxx.example.mydomain.hk.
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY,status: NOERROR,id: 12345
;; flags: qr rd ra; QUERY: 1,ANSWER: 1,AUTHORITY: 1,ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; ednS: version: 0,flags:; udp: 512
;; QUESTION SECTION:
;_66fxxxxxxxxx.example.mydomain.hk. IN A
;; ANSWER SECTION:
_66fxxxxxxxxx.example.mydomain.hk. 3599 IN CNAME _3ddxxxxxxxx.abcde.acm-validations.aws.
;; AUTHORITY SECTION:
abcde.acm-validations.aws. 899 IN SOA ns-75.awsdns-09.com. awsdns-hostmaster.amazon.com. 1 7200 900 1209600 86400
...
我该如何解决这个问题?
解决方法
终于为 *.example.mydomain.hk
添加了 CAA 记录,现在可以使用了。
*.example.mydomain.hk IN CAA 0 issue "amazon.com"