Merge pull request #190706 from dlepow/free

[APIM] Free cert issued by DigiCert

Author: PRMerger4

articles/api-management/configure-custom-domain.md

@@ -161,6 +161,9 @@ Choose the steps according to the [domain certificate](#domain-certificate-optio
 * Configure a CNAME record for your custom domain. 
 * When using API Management's free, managed certificate, also configure a TXT record to establish your ownership of the domain.
 
+> [!NOTE]
+> The free certificate is issued by DigiCert. For some domains, you must explicitly allow DigiCert as a certificate issuer by creating a [CAA domain record](https://wikipedia.org/wiki/DNS_Certification_Authority_Authorization) with the value: `0 issue digicert.com`.
+
 ### CNAME record
 
 Configure a CNAME record that points from your custom domain name (for example, `api.contoso.com`) to your API Management service hostname (for example, `<apim-service-name>.azure-api.net`). A CNAME record is more stable than an A-record in case the IP address changes. For more information, see [IP addresses of Azure API Management](api-management-howto-ip-addresses.md#changes-to-the-ip-addresses) and the [API Management FAQ](./api-management-faq.yml#how-can-i-secure-the-connection-between-the-api-management-gateway-and-my-back-end-services-).