Why can't a certificate be issued?
When a certificate will not come about, it is almost never the certificate. It is the check before it, and three causes for that can be seen from the outside.
What does that mean?
Before a certificate authority issues a certificate, it checks two things: whether the domain is yours and whether it is allowed to issue at all. Either can fail, and neither has anything to do with your website.
The permission sits in the CAA record. It names the authorities allowed to issue for your domain. Every certificate authority has to read it before issuing and stick to it, even when it served the same domain the year before. If a different authority is named there, it stops. With no CAA record, any of them may.
Proof that the domain is yours usually runs through the HTTP-01 method: the server puts a file in place and the certificate authority fetches it unencrypted over port 80. If the port is blocked or nothing answers there, that method drops out. The alternative is DNS-01, a record in DNS, but not every host can set that automatically.
So this tool checks three things: the CAA record, whether an address is on record at all, and whether port 80 answers. If a certificate is already sitting on the server, it also compares that certificate's issuer with the CAA record.
In short
The most common case: the CAA record is still from the old provider and the certificate is meant to come from the new one. The website keeps running, the renewal fails.
What can go wrong?
- The CAA record allows only one authority, and your host uses a different one.
- The record has a semicolon with no name in front of it. Word for word that means: nobody may issue.
- Port 80 is blocked, often with the best of intentions, because everything is
supposed to run over
https. The check needs it anyway, if only for the redirect. - The certificate authority put the brakes on after too many failed attempts. Then waiting helps, usually an hour, at Let's Encrypt up to a week.
- The record in DNS is set but has not reached everyone yet. With a long lifetime on the old answer, that takes a while.
How do you fix it?
You change the CAA record wherever the DNS records for your domain are managed, and the provider stands in the result above. Either take in the authority your host uses, or remove the record altogether. Both are a matter of minutes; afterwards you only wait for the old answer to run out.
Port 80 gets opened by the host, not by DNS. It need do nothing there but redirect to
https, and for the check that is enough.
Questions that usually come up together:
