Instant SSL certificate creation stuck in "Performing CAA validation step" on a Plesk server

Symptoms

• Instant SSL Certificate is stuck in "Performing CAA Validation" step.
• Domain nameserver is pointed to the registrar DNS servers or an external server.

Cause

CAA required entries are not available in the domain's DNS records.

Resolution

Please add the following entries to your DNS:

example.com. IN CAA 0 issuewild "sectigo.com"
example.com. IN CAA 0 issue "sectigo.com"
example.com. IN CAA 0 issuemail "sectigo.com"

Note: For assistance in adding these records on the registrar nameserver, contact the registrar support.

Additional information

• Sectigo documentation: CAA Record - Certification Authority Authorization