From a76b5753399b05a196eca7f20e577537226dd7ae Mon Sep 17 00:00:00 2001 From: Gusted Date: Tue, 30 Jun 2026 00:49:18 +0200 Subject: [PATCH] Update CAA recommendation (#822) Caddy will first try against staging, so this also requires a CAA record. Reviewed-on: https://codeberg.org/Codeberg/Documentation/pulls/822 --- content/codeberg-pages/using-custom-domain.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/content/codeberg-pages/using-custom-domain.md b/content/codeberg-pages/using-custom-domain.md index 48f3bd6..3eed61d 100644 --- a/content/codeberg-pages/using-custom-domain.md +++ b/content/codeberg-pages/using-custom-domain.md @@ -25,8 +25,10 @@ and configure it to serve content from Codeberg Pages. {% admonition "warning" "Known pitfalls for failed certificate errors" %} If you have a [CAA record](https://en.wikipedia.org/wiki/DNS_Certification_Authority_Authorization#Record) configured, -you must [explicitly allow Let's Encrypt in your CAA record](https://letsencrypt.org/docs/caa/). -The value of the CAA record would look like `letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/292520050;validationmethods=tls-alpn-01,http-01`. +you must [explicitly allow Let's Encrypt (staging) in your CAA record](https://letsencrypt.org/docs/caa/). +This means you need to add two extra CAA records. +The first record has a value of `letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/292520050;validationmethods=tls-alpn-01,http-01`. +The second record has a value of `letsencrypt.org;accounturi=https://acme-staging-v02.api.letsencrypt.org/acme/acct/272029763;validationmethods=tls-alpn-01,http-01`. If you're using [DNSSec](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions) on your custom domain, you might run into TLS certificate issues because `codeberg.page` doesn't use DNSSec at the moment. In this case you must add `A` / `AAAA` / `TXT` records for all domains instead of `CNAME` records. You can use [this tool](https://dnssec-analyzer.verisignlabs.com) to verify your setup.