ACME readiness check
Before a certificate can renew itself, three things have to be true, and the error a client shows when one of them is not is rarely clear. This ACME readiness check reads them from outside: the CAA records on the host and every parent up to the domain, whether port 80 answers on the HTTP-01 challenge path or redirects away from it, and whether _acme-challenge is delegated by CNAME for DNS-01.
Free, no signup. Reads CAA, port 80 and the _acme-challenge record from outside, the way Let's Encrypt does.
What the check covers
CAA, the way the CA reads it
RFC 8659 says the record set that applies is the closest one going up the tree, and no record anywhere means any CA may issue. An issue record for another CA, or an empty one, makes Let’s Encrypt refuse with a message that does not say why. The check names the record and the line to add.
Port 80, from the whole internet
HTTP-01 needs port 80 open to the world, not just to you. The check requests a challenge URL the way the CA would and reports an answer, a redirect to HTTPS on the same host (fine), a redirect to another host (the challenge has to be served there), or nothing at all.
DNS-01 without handing over zone keys
A CNAME from _acme-challenge to a delegated zone lets the client answer DNS-01 without API access to your main DNS. The check reports whether one exists. Hosts with no port 80 at all, mail servers included, get certificates this way.
Common questions
Why does Let’s Encrypt say "CAA record for example.com prevents issuance"?
A CAA record on the host, or on a parent domain, names one or more certificate authorities and letsencrypt.org is not among them. CAA is inherited downwards, so a record on the apex applies to every subdomain that has none of its own. Add 0 issue "letsencrypt.org" at the name the check reports, or at the host itself to override the parent.
Do I have to open port 80 for Let’s Encrypt?
For HTTP-01, yes: the CA connects to port 80 from several places on the internet and follows redirects, including to HTTPS. If you cannot open port 80, use DNS-01, which proves control through a TXT record instead and works for wildcards too.
What is _acme-challenge delegation?
A CNAME from _acme-challenge.yourhost to a zone the ACME client can write to, such as an acme-dns instance or your CDN. The client answers the DNS-01 challenge there, so it never needs credentials for your main DNS provider.
Does passing this check mean renewals will work?
It means the CA can validate the host. The client still has to run on a schedule, reload the server after it renews, and ideally ask the CA when to renew (ACME Renewal Information, which certbot, Caddy and lego support). CertPost watches the certificate the host serves and tells you when the CA expected a renewal that did not happen.