Route 53 Problems with CAA Records

[QuarkSolution]

SYSTEM INFORMATION
OS type and version	Rocky Linux 9.1
Webmin version	2.001
Virtualmin version	7.3

Hi! First of all, thank you for making such an awesome piece of software that makes it so easy to manage webservers! Now back to the problem: I have Route 53 set up as my cloud DNS provider. Whenever I try to issue any wildcard certificates, Virtualmin tries to update existing CAA records (as it should) in Route 53, but, for some reason does not follow the syntax needed for updating CAA records. I am getting this error:

Hook ‘–manual-auth-hook’ for domain.tld reported error code 255
Hook ‘–manual-auth-hook’ for domain.tld ran with error output:
Failed to update DNS records :
An error occurred (InvalidChangeBatch) when calling the ChangeResourceRecordSets operation: [Invalid Resource Record: ‘FATAL problem: CAARRDATAInvalidValue (Invalid value) encountered with ‘Value is not inside quotation mark letsencrypt.org’’]

It does not matter if I update the CAA record manually.

[stefan1959]

Well it complaining about quotation marks. The CAA records should be
example.com. CAA 0 issuewild “letsencrypt.org” with letsencrypt.org being in quotation marks.

this may help as well

DNS CAA Records

I just wanted to expand a little bit on the very useful topic raised by @vincen. I thought it might be useful to explain the records syntax and their purpose and to post a link to a simple and useful; tool to help with CAA record creation and checking (see below). The following entry, will allow the issuing of non-wildcard AND wildcard certificates for the specified domain, only by the specified CA (in this case Lets Encrypt): example.com. IN CAA 0 issue “letsencrypt.org” The entry below wi…

[QuarkSolution]

Hi, stefan1959. I think your reply missed the mark here. I already know that letsencrypt.org should be inside quotation marks. When you request a wildcard SSL certificate using Virtualmin, you do not get to choose what records Virtualmin will update in the backend, it updates your _acme-challenge TXT records automatically itself, and when requesting a wildcard SSL certificate, it also updates the CAA record. The problem arises somehow in my installation when Virtualmin tries to update the CAA record without quotation marks in Route 53.