SSL/TLS Certificate - CAA records
Requests for Incommon/CertiNext certificates will be prevented from being issued if your domains/DNS have CAA records that do not include emsign.com
https://spaces.at.internet2.edu/plugins/viewsource/viewpagesrc.action?pageId=399868137
You can use DNS lookup and various online tools to check for CAA: https://www.entrust.com/resources/certificate-solutions/tools/caa-lookup
DNS Requests? Network - DNS Registration FAQ