SOLVED How do I activate SSL on my host site?

[Team Dawes]

I'm getting this message in appdrag when I click the Main domain & SSL feature:
SSL Status:

You need to add this CNAME in your domain provider to validate the SSL certificate
CNAME Key: _d561c9638c05688b1795fa9aa1bd438d
CNAME value: _3e06a47c5dda9fa14e0778be51a41984.xlfgrmvvlj.acm-validations.aws.

I put this entry in my domain provider:
CNAME Record
Host: _d561c9638c05688b1795fa9aa1bd438d
Value:
_3e06a47c5dda9fa14e0778be51a41984.xlfgrmvvlj.acm-validations.aws.

I still get the error in Appdrag. How do I fix it?

[Joseph Benguira]

@team-dawes said in How do I activate SSL on my host site?:

_d561c9638c05688b1795fa9aa1bd438d

issue is you have a CAA dns record on your domain that is preventing AWS ACM to generate the certificate, please add this dns records to allow AWS to generate certificates for your domain:

toolk.it.com. IN CAA 0 issue "amazon.com"
toolk.it.com. IN CAA 0 issuewild "amazon.com"

[Team Dawes]

@joseph-benguira ,
Thanks for the advice.

I added them:
CAA Record toolk.it.com 0 issue "amazon.com"

CAA Record toolk.it.com 0 issuewild "amazon.com"

[Team Dawes]

I did what you suggested. There's a reply from me waiting in your queue.
I came back to this site and it said it was waiting to post the certificate.
I came back 15 minutes later and got this:

You need to add this CNAME in your domain provider to validate the SSL certificate
CNAME Key: _d561c9638c05688b1795fa9aa1bd438d
CNAME value: _3e06a47c5dda9fa14e0778be51a41984.xlfgrmvvlj.acm-validations.aws.

which again is already in my CNAME.

[Joseph Benguira]

@team-dawes said in How do I activate SSL on my host site?:

_d561c9638c05688b1795fa9aa1bd438d

I can see the DNS verification is OK
but AWS ACM still return an error when generating your certificate:
"FailureReason":"CAA_ERROR"

I've checked if you added the CAA records, and it seems they are not there, you can check it here:
https://dnschecker.org/#CAA/toolk.it.com

[Team Dawes]

Hey Joseph, I think I have it all set up.
And the site isn't showing at all.

What needs to happen?

[Joseph Benguira]

@team-dawes issue is the CAA record seems not propagated as you can see here:
https://dnschecker.org/#CAA/toolk.it.com

[Team Dawes]

@joseph-benguira, yes, I get that the CAA record hasn't propagated. I check it every day, a couple of times a day.
What's my next step?
How do I get it to propagate?

[Joseph Benguira]

@team-dawes you have to contact your registrar, it should be propagated in few hours, not taking days. Only the registrar can help with that.

Another option is to use cloudflare:
https://support.appdrag.com/doc/Use-CloudFlare-and-Activate-SSL