A website launch can resolve the right IP yet wait for certificate issuance. Before changing DNS or certificate suppliers, commission a read-only evidence pack that separates hostname routing, issuer permission and actual certificate status. Do not delete security records as a troubleshooting shortcut.
Primary evidence and claim boundaries
Cloudflare explains that CAA specifies permitted certificate authorities and that inherited parent-domain records can matter. Automatic records differ between Universal SSL and Advanced certificates. Primary reference · Read 17 October 2026.
Filled acceptance example
Synthetic teaching scenario, not a client case, provider integration test or business result. Scroll the example table on narrow screens.
| Synthetic launch evidence | What it establishes | What remains unknown |
|---|---|---|
| www resolves to expected host | Routing observation | Certificate issuance/hostname coverage |
| Parent CAA only permits ca-a.example | Declared issuer policy | Whether chosen supplier uses that authorised CA |
| Dashboard has no visible automaticCAA | UI observation only | Public DNS may include provider-added records |
| Certificate statusActive; SAN containswww | Issuer reports active matching certificate | Actual TLS presentation still needs verification |
Practical handover procedure
- Record exact hostname, authoritative DNS provider, parent/subdomain arrangement and certificate product. Read current CAA answers and inheritance with timestamps; keep unrelated records untouched.
- Ask the hosting supplier for the intended issuer, validation status and supported CAA guidance. Compare observed DNS with that exact product instead of copying a generic allow-list.
- Have the authorised owner approve any proposed DNS change separately. After authorised issuance, verify hostname/SAN, chain, expiry and actual TLS response before declaring the launch ready.
Interpret the outcome
The matrix keeps a routing success from becoming a certificate success claim. A CAA mismatch is one candidate explanation, not the established cause of every pending certificate. The evidence pack should preserve both the public answer and the platform status so a supplier can resolve the actual layer.
Acceptance decision
Require consistent hostname, issuer permission, successful validation and live TLS evidence. Unknown product or inherited records block an issuance conclusion, not justify weakening policy.
Limits and unverified work
Synthetic domain names and statuses; no DNS query, configuration change, certificate purchase or security bypass was performed. This is not a universal Cloudflare/Sites setup procedure.
Download the filled bilingual acceptance record — Contains these inputs, steps, expectations and limits. This is a teaching record, not an executable integration.