Okta Custom Domain Certificate Renewal Limits When DNS Records Change

Okta provisions and manages the TLS certificate for a custom sign-in domain automatically once the domain's CNAME record validates, so administrators do not upload their own certificate in the standard flow. What is less clear is which DNS conditions must remain in place afterward for certificate renewal to keep succeeding.

Initial issuance depends on public resolution of the CNAME to the Okta-provided target, and it can be blocked by CAA records that do not authorize Okta's certificate authority, or by proxy modes that mask the CNAME target. Renewal timing and whether renewal re-validates DNS the same way appear to be tenant-dependent details that current Okta documentation should confirm.

Specifically:

• Does certificate renewal repeat the same public DNS validation, so that removing or changing the CNAME after initial setup causes renewal failure and a custom domain outage?
• Must CAA records continue to authorize Okta's certificate authority for the lifetime of the custom domain, or only during initial issuance?
• Is there a documented limit on how long failed validation can persist before the managed certificate lapses?