# Caa record preventing issuance of ssl cert

**URL:** <https://answers.netlify.com/t/caa-record-preventing-issuance-of-ssl-cert/115747>\
**Category:** Support\
**Tags:** netlify-dns-https-ssl, deployment\
**Created:** [April 2, 2024, 4:24pm UTC](https://answers.netlify.com/t/caa-record-preventing-issuance-of-ssl-cert/115747 "2024-04-02T16:24:48Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![OlgitH](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/olgith/32/60003_2.png) [@OlgitH](https://answers.netlify.com/u/OlgitH)\
**Post date:** [April 2, 2024, 4:24pm UTC](https://answers.netlify.com/t/caa-record-preventing-issuance-of-ssl-cert/115747/1 "2024-04-02T16:24:48Z")

</div>

PLEASE help us help you by writing a good post!

> **[Research that helps brands grow | The Nursery](https://the-nursery.net)**
>
> The experts in brand, communications and experience research.

This site is down because netlify can’t reissue the ssl cert. I am getting an error in netlify saying “caa record prevents issuance”

The domain administrator stated there was a caa record in place on the apex domain. This is for another service running on a subdomain, however he doesn’t want to remove it. Instead he changed the host in the caa record from @ to the name of the subdomain they use - but I am still seeing the caa record show up for the apex domain.

What do I need to do to allow netlify to reissue the ssl cert? Is there a way around this?

---

<div class="post-metadata">

**Author:** ![dig](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/dig/32/56744_2.png) [@dig](https://answers.netlify.com/u/dig)\
**Post date:** [April 2, 2024, 8:29pm UTC](https://answers.netlify.com/t/caa-record-preventing-issuance-of-ssl-cert/115747/2 "2024-04-02T20:29:07Z")

</div>

> [@OlgitH](#):
>
> This site is down

The site is working fine for me. And it has an SSL certificate.

> [@OlgitH](#):
>
> Instead he changed the host in the caa record from @ to the name of the subdomain they use

This sounds ike a good idea.

> [@OlgitH](#):
>
> but I am still seeing the caa record show up for the apex domain.

DNS record propagation takes time.

> [@OlgitH](#):
>
> What do I need to do

Nothing. It’s working now! 🎉

---

<div class="post-metadata">

**Author:** ![OlgitH](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/olgith/32/60003_2.png) [@OlgitH](https://answers.netlify.com/u/OlgitH)\
**Post date:** [April 2, 2024, 8:43pm UTC](https://answers.netlify.com/t/caa-record-preventing-issuance-of-ssl-cert/115747/3 "2024-04-02T20:43:52Z")

</div>

Thanks. I eventually got him to remove the caa record and that it wouldn’t bring down the other site, and this fixed the problem.