aWe have the following DNS configuration in place to allow our clients to use vanity URLs to our services:
sub1.clientA.com CNAME clientA.our-domain.com *.our-domain.com CNAME nlb-sub.amazonaws.com nlb-sub.amazonaws.com A <some-ips>
We use Let's Encrypt to provide a cert for the sub domain sample1.clientA.com. Note we currently have no CAA records in place ourselves.
However one of our clients, i.e. clientA has two restrictive CAA records in place for their root domain
clientA.com CAA 0 issuewild "ca1.com" clientA.com CAA 0 issue "ca1.com"
Currently, Let's Encrypt cannot issue a cert for sample1.clientA.com. It returns a 403 error:
CAA record for sample1.clientA.com prevents issuance.
More than likely because of the restrictive CAA records.
Should we ask our client to set up a permissive CAA record for its root domain? Or, given that CAA validation follows CNAMEs like all other DNS requests, should it be put on the nlb-sub.amazonaws.com subdomain?
We are not using Route53 and AFAIK our DNS provider does not support ALIAS records.