From 626edec8cd56867554af72408d1eddba7a9618a0 Mon Sep 17 00:00:00 2001 From: josh-konghq Date: Fri, 31 Jan 2025 12:43:58 -0500 Subject: [PATCH 1/2] Update custom-dns.md Updated to include instructions for CAA Records --- .../dedicated-cloud-gateways/custom-dns.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/app/konnect/gateway-manager/dedicated-cloud-gateways/custom-dns.md b/app/konnect/gateway-manager/dedicated-cloud-gateways/custom-dns.md index ddec6e68a52..40c9ae953d6 100644 --- a/app/konnect/gateway-manager/dedicated-cloud-gateways/custom-dns.md +++ b/app/konnect/gateway-manager/dedicated-cloud-gateways/custom-dns.md @@ -37,3 +37,17 @@ title: Custom Domains for Dedicated Cloud Gateways 1. In {{site.konnect_short_name}}, open {% konnect_icon runtimes %} **Gateway Manager**, choose a control plane to open the **Overview** dashboard, then click **Custom Domains**. 2. Click the action menu on the end of the row you want to delete and click **Delete**. + +## Custom Domain Attachment & CAA Record Issue + +If your custom domain attachment fails, check if your domain has a CAA record restricting certificate issuance. Dedicated Cloud Gateways uses GCP Public CA to provision SSL/TLS certificates. If your CAA record does not include the required CA, certificate issuance will fail. + +Steps to Fix: +1. Check existing CAA records + * Run: dig CAA yourdomain.com +short + * If a CAA record exists but doesn't allow GCP Public CA (pki.goog), update it. +2. Update the CAA record (if needed) + * yourdomain.com. CAA 0 issue "pki.goog" +3. Wait for DNS propagation and retry attaching your domain. + +If no CAA record exists, no changes are needed. More details: [Let's Encrypt CAA Guide](https://letsencrypt.org/docs/caa/) From 5b88cf02a3148a94bf9004c37d1efb45f6d2a9c2 Mon Sep 17 00:00:00 2001 From: Diana <75819066+cloudjumpercat@users.noreply.github.com> Date: Fri, 31 Jan 2025 14:42:48 -0600 Subject: [PATCH 2/2] Apply suggestions from code review --- .../dedicated-cloud-gateways/custom-dns.md | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/app/konnect/gateway-manager/dedicated-cloud-gateways/custom-dns.md b/app/konnect/gateway-manager/dedicated-cloud-gateways/custom-dns.md index 40c9ae953d6..3d520e9bd32 100644 --- a/app/konnect/gateway-manager/dedicated-cloud-gateways/custom-dns.md +++ b/app/konnect/gateway-manager/dedicated-cloud-gateways/custom-dns.md @@ -38,16 +38,15 @@ title: Custom Domains for Dedicated Cloud Gateways 2. Click the action menu on the end of the row you want to delete and click **Delete**. -## Custom Domain Attachment & CAA Record Issue +## Custom domain attachment and CAA record troubleshooting -If your custom domain attachment fails, check if your domain has a CAA record restricting certificate issuance. Dedicated Cloud Gateways uses GCP Public CA to provision SSL/TLS certificates. If your CAA record does not include the required CA, certificate issuance will fail. +If your custom domain attachment fails, check if your domain has a Certificate Authority Authorization (CAA) record restricting certificate issuance. Dedicated Cloud Gateways uses a Google Cloud Public CA to provision SSL/TLS certificates. If your CAA record doesn't include the required CA, certificate issuance will fail. -Steps to Fix: -1. Check existing CAA records - * Run: dig CAA yourdomain.com +short - * If a CAA record exists but doesn't allow GCP Public CA (pki.goog), update it. -2. Update the CAA record (if needed) - * yourdomain.com. CAA 0 issue "pki.goog" +You can resolve this issue by doing the following: + +1. Check existing CAA records by running `dig CAA yourdomain.com +short`. + If a CAA record exists but doesn't allow GCP Public CA (`pki.goog`), update it. +2. Update the CAA record, if needed. For example: `yourdomain.com. CAA 0 issue "pki.goog"` 3. Wait for DNS propagation and retry attaching your domain. -If no CAA record exists, no changes are needed. More details: [Let's Encrypt CAA Guide](https://letsencrypt.org/docs/caa/) +If no CAA record exists, no changes are needed. For more information, see the [Let's Encrypt CAA Guide](https://letsencrypt.org/docs/caa/).