From 2004bf605098302364b59b400447d1aec6c4d46b Mon Sep 17 00:00:00 2001 From: Bryan Frimin Date: Wed, 25 Mar 2026 12:11:08 +0100 Subject: [PATCH] Fix CAA issuer matching to handle parameters CAA issue records may contain parameters after a semicolon per RFC 8659 (e.g. "letsencrypt.org; accounturi=..."). Split on ";" and compare only the issuer domain so these records are accepted. Signed-off-by: Bryan Frimin --- pkg/certmanager/provisioner.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/pkg/certmanager/provisioner.go b/pkg/certmanager/provisioner.go index 991e7014a..ec631bdf9 100644 --- a/pkg/certmanager/provisioner.go +++ b/pkg/certmanager/provisioner.go @@ -171,8 +171,11 @@ func (p *Provisioner) checkCAARecords(domain string) error { } for _, caa := range caaRecords { - if caa.Tag == "issue" && strings.EqualFold(caa.Value, p.caaIssuerDomain) { - return nil + if caa.Tag == "issue" { + issuer, _, _ := strings.Cut(caa.Value, ";") + if strings.EqualFold(strings.TrimSpace(issuer), p.caaIssuerDomain) { + return nil + } } }