Troubleshooting guide

SSL certificate pending or invalid

Issuance requires the certificate authority to validate the requested names against the correct destination and policy.

4 diagnostic facts3 controlled stages4 acceptance checks1 primary references

Diagnose before changing

  1. 01Check A/AAAA/CNAME
  2. 02Check CAA
  3. 03Check proxy mode
  4. 04Inspect certificate names and chain
  1. 01

    Fix reachability

    Every requested hostname must resolve to an account that can answer validation.

  2. 02

    Remove only proven blockers

    Do not delete AAAA or CAA blindly; compare them with provider requirements.

  3. 03

    Reissue and verify

    Retry through the provider control and test chain, expiry and redirect behavior.

Acceptance gate

Prove the result

Record timestamp, tester and evidence for every check before closing the incident or change.

Root/www coverage

Expected result documented and verified from the affected user path.

Pass / fail / blocked
Trusted chain

Expected result documented and verified from the affected user path.

Pass / fail / blocked
HTTP redirects once

Expected result documented and verified from the affected user path.

Pass / fail / blocked
Renewal automation

Expected result documented and verified from the affected user path.

Pass / fail / blocked

Primary references

Return to the operations library

Browse all help guides →