SSL certificate error after creating custom training URL (CAA update required)

If you have customized your training URL using a custom domain but receive a browser error when reaching your new URL, it is likely that your domain does not allow certificates to be generated by Google Trust Services LLC.

When your new URL is set as the "Primary domain", a certificate is automatically generated and applied. However, you may need to add an additional record to the domain's DNS - a CAA record.

CAA records are a control measure at the domain level. The domain administrator may add a CAA record to allow any or all Certificate Authorities from generating certificates to the domain.

To resolve this issue, you will need to create a CAA record that permits Google to generate the certificate for your domain. The record should look something like this:

For more information on how to configure CAA, here is a tool by SSLMate that will help you to easily generate the record required by your domain: https://sslmate.com/caa/