What happens to a Replit custom domain's HTTPS certificate when a CAA record is added after issuance?

Answer to the Exact Question

When you add a CAA record that blocks Let’s Encrypt after Replit has already issued a certificate for your custom domain, Replit’s current certificate remains valid and is served until its expiration. The platform will still attempt to renew the certificate during its scheduled renewal cycle, but if the renewal fails because of the new CAA restriction, Replit marks the domain with a warning icon and a tooltip that indicates a CAA‑related renewal failure. The old certificate is not immediately revoked; it stays in service until the renewal succeeds or the certificate expires.

Likely Explanation (What We Know)

• Replit uses Let’s Encrypt for all custom‑domain certificates.
• Renewal attempts happen automatically about 60 days before expiry.
• A CAA record that denies Let’s Encrypt blocks the renewal request.
• The UI shows a warning icon next to the domain name; hovering displays a message such as “Certificate renewal failed: CAA restriction detected.”
• Until renewal succeeds, the domain still appears as “Secure” in the dashboard because the existing cert is still valid.

Confirmed Facts (Based on Current Replit Behavior)

1. The existing TLS certificate is served unchanged until it expires.
2. Replit’s automated renewal process still runs; it does not skip the renewal entirely.
3. If renewal fails, Replit logs the error internally and shows a warning icon in the UI.
4. There is no immediate revocation or replacement of the old cert.
5. Detailed error codes are only visible in internal logs (not exposed to the end user).

Steps to Verify and Resolve

1. Check the Replit dashboard for your custom domain. Look for a warning icon (⚠️) beside the domain name.
2. Hover over the icon to read the tooltip; it should mention a CAA restriction.
3. Use an external TLS inspection tool (e.g., openssl s_client -connect yourdomain.com:443) to confirm that the certificate presented is still the old one.
4. If you have access to Replit logs (usually via the “Logs” tab or support portal), search for entries containing CAA or certificate renewal failed to confirm the cause.
5. To restore automatic renewal, modify or remove the offending CAA record so that Let’s Encrypt is allowed, then wait for the next renewal window.

Diagnostic Detail Needed?

Does your Replit plan provide access to detailed renewal logs, or do you only see the warning icon in the dashboard? Knowing this will help determine whether you can view the exact CAA error message or need to contact support for deeper diagnostics.