Resolve SSL Certificate errors

Managing your SSL Certificate on CloudCannon requires you to host your Site through CloudCannon. If an external service hosts your Site, please review its documentation on SSL Certificates.

CloudCannon issues a free auto-generated SSL Certificate for each Subdomain you host on CloudCannon. Most certificates issue within a few minutes of the Subdomain's DNS pointing at CloudCannon, but a certificate can stay waiting, or fail to issue or renew, when the Subdomain's DNS isn't set up correctly.

Most SSL Certificate errors come down to DNS: the certificate authority must confirm that your Subdomain points at CloudCannon before it can issue a certificate.

SSL Certificate emails#

CloudCannon emails everyone who can edit the settings of the Base Domain (the base-domain:settings:details:write permission) when a certificate keeps failing to issue, and again once it issues.

Action required: [Subdomain]'s SSL Certificate is failing to issue

CloudCannon sends this email once a certificate has failed to issue 23 or more times, and only while the Subdomain's DNS is Configured. The email says how many attempts failed, what to do next, and what usually fixes it, with an Open the Subdomain page for [Subdomain] button. The HTTPS section of the Subdomain page shows the last error and a Retry now button.

[Subdomain]'s SSL Certificate is now active

CloudCannon sends this email when a certificate issues after CloudCannon sent the failing email for it. The email shows the active certificate and what the Subdomain serves, with a Visit [Subdomain] button.

Check your SSL Certificate status#

The HTTPS section of the Subdomain page explains the state of the certificate, and the HTTPS column of the Subdomains tab shows a short status for every Subdomain. The Summary tab of the Domain page also names the Subdomains with certificate problems on the [Number] of [Number] Subdomains need attention Card. Click the Fix Subdomains button on the Card to see those Subdomains on the Subdomains tab.

If your account has the Health tab on the Organization Home page, it lists the Subdomains across your Organization whose SSL Certificate has expired, and those whose certificate failed to renew and expires within seven days, with a link to each Subdomain page. The Health tab is available through a private Beta, which CloudCannon enables for individual accounts. To request access, please contact our friendly support team.

The HTTPS section shows one of these headings:

• Waiting for DNS — The Subdomain's DNS record doesn't point at CloudCannon yet. HTTPS turns on by itself once it does. On Cloudflare Proxy, the heading is Waiting for your proxied record until an attempt to issue the certificate fails. If an attempt to issue the certificate has already failed, the section shows which attempt failed, why, and when CloudCannon tries again.
• Waiting for nameservers — Your domain uses CloudCannon DNS, and its nameservers don't point at CloudCannon DNS yet. HTTPS turns on by itself once they do. For more information, please read our documentation on configuring CloudCannon DNS.
• Turning HTTPS on — CloudCannon is requesting the certificate. This usually takes a few minutes. If an attempt has already failed for a reason other than DNS, the section shows which attempt failed, why, and when CloudCannon tries again.
• HTTPS is on — The certificate is active, and the section shows the date by which CloudCannon renews it. For an uploaded certificate, it shows the date until which the certificate is valid instead. If an attempt to renew the certificate CloudCannon keeps for its origin servers has failed, a note says so. Visitors are not affected.
• Renewing the SSL certificate — CloudCannon is renewing the certificate, or a renewal attempt failed and CloudCannon is trying again. The current certificate is valid until the date shown, so visitors are not affected. If an attempt failed, the section says why, and when CloudCannon tries again or that it has stopped.
• The SSL certificate expires in [Number] days — Renewal is failing, and the current certificate expires within seven days. On the last day, the heading reads The SSL certificate expires today. Fix the problem before the date shown, or visitors see a security warning.
• The SSL certificate expired — Visitors who open https:// see a security warning. The section says what brings HTTPS back: a successful renewal attempt, the Subdomain pointing at CloudCannon again, clicking the Retry now button, or uploading a new certificate.
• HTTPS could not be turned on — CloudCannon stopped after 40 failed attempts. Fix the problem, then click the Retry now button. If the problem was the Subdomain's DNS record, CloudCannon also starts trying again on its own once the record points at CloudCannon.
• HTTPS setup timed out — Cloudflare's request for the certificate timed out. Check that the DNS section shows Configured, then click the Retry now button.
• [Subdomain] stopped pointing at CloudCannon — Cloudflare found that the Subdomain's DNS record no longer points at CloudCannon, so HTTPS is off until it does. Change the record at your DNS Provider back to the record shown in the DNS section, then click the Retry now button.
• Cloudflare is blocking [Subdomain] — A zone hold on your Base Domain in another Cloudflare account blocks HTTPS for the Subdomain. A zone hold is a Cloudflare setting that stops any other Cloudflare account, including CloudCannon's, from serving the domain. Release the zone hold in that account, then click the Retry now button. If you don't have access to that account, contact our support team.
• CloudCannon could not apply the HTTPS settings — Cloudflare rejected the HTTPS settings, for example because an uploaded certificate has expired. Click the Retry now button, or click the Configure HTTPS button and choose another certificate.
• HTTPS is off — The Subdomain is set to use an uploaded certificate, but none is selected. Click the Configure HTTPS button, then choose a certificate or let CloudCannon issue one. If an uploaded certificate expires while a Subdomain still uses it, CloudCannon switches that Subdomain to Let CloudCannon issue and renew it within the hour. For more information, please read our documentation on adding a Custom SSL Certificate.
• Setting HTTPS up again — CloudCannon is changing the certificate. This usually takes a few minutes, and there is nothing to do.
• Updating the SSL certificate — CloudCannon is changing the certificate. This usually takes a few minutes, and there is nothing to do.

Until HTTPS is on, visitors who open the https:// address of the Subdomain see a security warning in their browser.

To check your SSL Certificate status:

1. Log in to CloudCannon.
2. Select the Organization your Custom Domain is connected to.
3. Click the Custom Domains link in the App Sidebar. CloudCannon will open the Domains Browser.
4. Click the Card for the domain you want to check. CloudCannon will open the Summary tab of the Domain page.
5. Click the Subdomains tab. CloudCannon will open the list of Subdomains.
6. Click the Card for the Subdomain you want to check. CloudCannon will open the page for that Subdomain.
7. Review the status in the HTTPS section.
8. (Optional.) Click the See the last error button. CloudCannon will open the HTTPS problem on [Subdomain] modal.

CloudCannon will show the current state of the certificate, and the modal explains the latest failure.

The HTTPS problem on [Subdomain] modal shows which attempt failed (e.g., Attempt 2 of 40), when it failed, when the next automatic attempt is, and the error code to include if you contact support, with a Copy icon. Below those details, it explains what went wrong and what to change. When the problem is DNS, the View DNS checks link opens the history of CloudCannon's DNS checks for the Subdomain. Click the Retry now button in the modal to try again immediately.

Check your DNS#

The DNS section of the Subdomain page says whether the Subdomain points at CloudCannon, and shows the record it Needs, the records CloudCannon Found, and its Status: Configured, Not pointing at CloudCannon, No DNS Record, Not checked yet, or, in the 48 hours after you add the Subdomain, change its hosting, change your DNS Provider, or mark its record as updated, Checking. The footer of the table says how often CloudCannon checks and when it last checked. Click the Check now button in the footer to run a new check, or the View DNS check history icon to open the DNS checks for [Subdomain] modal, which lists earlier checks, including the address the Subdomain resolved to and whether a test request reached CloudCannon. You can check the DNS for each Subdomain at most once a minute: for a minute after a check, the Check now button is disabled, with the tooltip Checked less than a minute ago. You can check again in a minute. If CloudCannon couldn't complete the latest check, the footer says so and the table keeps the last known status.

To check your domain's DNS from outside CloudCannon, you can use a public tool such as DNSViz. Enter the subdomain to see which nameservers answer for it, the records they return, and any DNSSEC errors. DNSViz shows errors in red.

The Hosting section shows how visitors reach the Subdomain as a diagram. Click a connection in the diagram to see whether it works, what CloudCannon found, and what to change. For more information, please read our documentation on configuring a Subdomain's hosting, HTTPS, and DNS.

Resolve a certificate that is waiting for DNS#

A certificate stays waiting until the certificate authority can confirm that your Subdomain points at CloudCannon. Once the DNS record is correct, the certificate usually issues within a few minutes. If you added a Custom Domain or changed a DNS record a short time ago, the certificate stays waiting until the record spreads. Most DNS Providers publish new records within an hour, and some take up to 48 hours.

If the DNS section doesn't show Configured, add the record listed under Needs at your DNS Provider when your domain uses external DNS, or click the Fix button when it uses CloudCannon DNS. For more information, please read our documentation on configuring external DNS and configuring CloudCannon DNS.

To resolve a certificate that is waiting for DNS:

1. Check that the DNS section of the Subdomain page shows Configured.
2. Add any TXT records listed in the HTTPS section at your DNS Provider.
3. Wait for your DNS records to spread.

CloudCannon will validate the Subdomain and issue the certificate once it finds the record.

For more information, please read our documentation on issuing the SSL Certificate with TXT validation and renewing the wildcard SSL Certificate on external DNS.

Resolve a certificate that failed to issue#

When an attempt to issue or renew a certificate fails, CloudCannon shows the reason in the HTTPS section and tries again later, up to 40 times.

To resolve a certificate that failed to issue:

1. Click the See the last error button in the HTTPS section to identify the cause.
2. Correct your DNS configuration based on the cause.
3. Click the Retry now button to try again without waiting for the next attempt.

CloudCannon will attempt to issue the certificate again. If the certificate still fails after you have corrected your DNS configuration, contact our support team.

For more information, please read the section on common causes of SSL Certificate errors.

What the last error means

The HTTPS problem on [Subdomain] modal shows one of these explanations:

• CloudCannon could not reach [Subdomain], so it did not request an SSL certificate — The Subdomain's DNS doesn't point at CloudCannon yet. Check the record in the DNS section, and any proxy or CDN in front of the Subdomain.
• The certificate authority could not confirm that CloudCannon serves [Subdomain] — The certificate authority's check did not reach CloudCannon. Check that the DNS record for the Subdomain points at CloudCannon, and that no proxy or firewall in front of it blocks the check. A DNSSEC error can also cause this.
• A CAA record on [Subdomain] or a parent domain does not allow CloudCannon's certificate authority to issue SSL certificates — Add a CAA record that allows sectigo.com and the certificate authorities Cloudflare uses, or remove the CAA records. For more information, please read the section on common causes of SSL Certificate errors.
• [Subdomain] is not a valid domain name for an SSL certificate — Check that the Subdomain is spelled correctly.
• The certificate authority did not accept the request for an SSL certificate — The rejection is usually temporary, and the next attempt often succeeds.
• The previous request for an SSL certificate expired before it finished — CloudCannon starts a new request automatically.
• The SSL certificate was issued, but it did not finish installing — CloudCannon tries again automatically, and the next attempt usually succeeds.
• A temporary problem at CloudCannon interrupted the request for an SSL certificate — CloudCannon tries again automatically, and the next attempt usually succeeds. If the error keeps appearing, contact support.
• CloudCannon does not issue SSL certificates while the Organization's subscription is suspended — Update the payment details on the Subscription page under Org Settings, and CloudCannon tries again automatically.
• The request for an SSL certificate failed with an error CloudCannon does not recognize — Contact support with the error code shown in the modal.

Common causes of SSL Certificate errors#

• Missing or incorrect DNS records — Your Subdomain must point at CloudCannon. On external DNS, add the record CloudCannon shows for the Subdomain's hosting option. On CloudCannon DNS, CloudCannon manages these records for you, and the Fix button repairs a record that points somewhere else.
• Missing TXT records — If you use an external DNS Provider and the HTTPS section lists TXT records, you must add them at your DNS Provider. The wildcard SSL Certificate for your Base Domain needs new TXT records at each renewal, unless you add the CNAME record that lets Cloudflare renew it on its own. For more information, please read our documentation on renewing the wildcard SSL Certificate on external DNS.
• DNS records have not spread yet — Newly added or changed DNS records usually take effect within an hour, and can take up to 48 hours with some DNS Providers.
• A CAA record blocks the certificate authority — A CAA record is a DNS record that restricts which certificate authorities are allowed to issue certificates for your domain. A CAA record on your Base Domain also applies to its subdomains. If your domain has CAA records that don't include the authorities CloudCannon uses, CloudCannon doesn't request a certificate, and the HTTPS problem on [Subdomain] modal says that a CAA record does not allow CloudCannon's certificate authority. CloudCannon checks the CAA records on the subdomain first, then on each parent domain, and uses the closest ones it finds. To fix this, remove your CAA records, or add CAA records that allow sectigo.com, and letsencrypt.org, pki.goog, and ssl.com (for certificates from Cloudflare). A CAA record that allows one authority looks like 0 issue "sectigo.com", and you add one record for each authority. For more information, please read Cloudflare's documentation on CAA records for its certificate authorities.
• DNSSEC is misconfigured — If DNSSEC is turned on for your domain at your registrar, but your DNS Provider doesn't sign your records with matching keys, resolvers and certificate authorities reject your DNS answers. A DNSSEC mismatch often happens after you change DNS Provider without removing or updating the DS record at your registrar, which is the record that links your domain to your DNS Provider's DNSSEC keys. Check your domain with DNSViz. If it shows DNSSEC errors, turn DNSSEC off at your registrar, or update the DS record to match your DNS Provider. CloudCannon DNS doesn't support DNSSEC, so turn DNSSEC off at your registrar before you switch to CloudCannon DNS.
• Another platform still has the subdomain — If you are moving the subdomain from another platform that also serves websites through Cloudflare (e.g., Webflow), Cloudflare can keep sending visitors to that platform until the certificate on CloudCannon is active. For more information, please read our documentation on moving a subdomain from another platform that uses Cloudflare.
• The hosting option does not match your proxy — If your own Cloudflare zone proxies the Subdomain, or another provider proxies it to CloudCannon, set the Subdomain's hosting to Cloudflare Proxy or Single Origin. For more information, please read our documentation on configuring Cloudflare Proxy.
• A zone hold in another Cloudflare account — If your Base Domain is in another Cloudflare account with a zone hold, such as an account that belonged to a previous agency or platform, Cloudflare blocks CloudCannon from serving its subdomains, and the HTTPS section shows Cloudflare is blocking [Subdomain]. Release the zone hold in that account, then click the Retry now button. If you don't have access to that account, contact our support team.

Resolve an error page from Cloudflare#

CloudCannon serves your Sites through Cloudflare, so a problem with a Subdomain's DNS or certificate can show visitors an error page from Cloudflare instead of your Site or your Fallback Redirect. The most common causes are:

• The subdomain isn't set up on CloudCannon, and your domain uses external DNS — Visitors to a subdomain you haven't added, such as www.example.com, rely on the wildcard SSL Certificate for your Base Domain, which needs TXT records at your DNS Provider at every renewal. Add the Subdomain on CloudCannon instead, as a Redirect Subdomain if it should send visitors elsewhere. For more information, please read our documentation on SSL Certificates on external DNS.
• Your own Cloudflare zone proxies the subdomain — Set the Subdomain's hosting to Cloudflare Proxy, and point the record at orange-cloud.cloudcannon.com. For more information, please read our documentation on configuring Cloudflare Proxy.
• Another platform that uses Cloudflare still has the subdomain — For more information, please read our documentation on moving a subdomain from another platform that uses Cloudflare.

Contact support#

If your certificate still fails after you have corrected your DNS configuration and waited for your records to spread, contact our friendly support team. Include the following details so the support team can resolve your issue quickly:

• The name of the affected Site
• The Subdomain you are trying to secure
• The error code from the HTTPS problem on [Subdomain] modal, or a screenshot of the error page from Cloudflare, including its error code
• Your DNS Provider, and whether you use CloudCannon DNS or an external provider
• The hosting option for the Subdomain
• When you added the Custom Domain or last changed your DNS records