Readthedocs.org: ERR_CERT_COMMON_NAME_INVALID for Custom Domain

[colejarczyk]

Details

• Read the Docs project URL: docs.openloyalty.io
• Build URL (if applicable): no
• Read the Docs username (if applicable):divantespzoo

I've changed CNAME FROM readthedocs.org to readthedocs.io and then marked " Always use HTTPS for this domain" for docs.openloyalty.io

Currently status is pending_issuance and it's from a few days. What's wrong?

Expected Result

Working HTTPS for custom domain https://docs.openloyalty.io

Actual Result

For Firefox and Chrome I get:

NET::ERR_CERT_COMMON_NAME_INVALID
Subject: ssl403572.cloudflaressl.com
Issuer: COMODO ECC Domain Validation Secure Server CA 2
Expires on: 8 gru 2019
Current date: 9 lip 2019

[stsewd]

Can you try saving the domain?

Saving the domain will revalidate the SSL certificate

[colejarczyk]

I did that many times. I'm waiting almost a week. Tried everything I can. Without luck

[stsewd]

@davidfischer may help here

[davidfischer]

It looks like the domain openloyalty.io is using CAA records (Let's Encrypt's docs, Cloudflare's docs) to control which certificate authorities can issue certificates for it.

$ dig CAA openloyalty.io
...
;; ANSWER SECTION:
openloyalty.io.     1295    IN  CAA 0 issue "letsencrypt.org"
openloyalty.io.     1295    IN  CAA 0 issue "comodoca.com"
...

I'm not 100% sure, but I believe because there aren't explicit CAA records for docs.openloyalty.io that the root domain's are used. I can see that Cloudflare cannot issue the certificate due to a CAA error though.

I believe you'll need to add a CAA record to allow Cloudflare to issue the certificate.

[colejarczyk]

@davidfischer you're totally right! I thought it's enough to set CAA for subdomain but I had to set those on top level domain. Now it worked super fast (under a minute) and works like a charm.

I'm very thankful for your help :)