Skip to main content

Fix a Custom Domain That Won't Load or Get SSL

What to check when DNS records aren't found, the SSL certificate isn't issued, or visitors see the "Configuration in progress" page.

Written by Drago Crnjac

Overview

Most custom domain problems come down to a DNS record that's missing, mistyped, or still cached somewhere. Work through the checks below in order.

1. Check the domain's status in your dashboard

Open the upstream and find the domain on the Domains tab:

  • Proxy shows Confirmed once we find a CNAME, or both A records, pointing to us. While the records are missing it shows View Instructions. Click it to see the exact records to add.

  • DNS Challenge (DNS-01 domains only) turns green once we find the _acme-challenge record.

  • The SSL and Proxy chips under the domain name get a tick once the certificate is issued and the records are found.

We check DNS right after you create a domain, then every minute for the first 10 minutes, every 5 minutes until the first hour, and every 3 hours after that. To check again straight away, click View Instructions and then Verify DNS Records Now.

2. Make sure the records are right

  • Subdomains like app.customer.com: one CNAME record pointing to in.saascustomdomains.com (or to your custom CNAME).

  • Root domains like customer.com: two A records, 75.2.96.173 and 99.83.186.151. Both are required. The instructions window shows them under Use `A` records instead?

  • Redirect to www turned on: www.customer.com needs a record too, either the CNAME or the same two A records.

  • DNS-01 challenge, which every wildcard domain uses: also a CNAME from _acme-challenge.customer.com to _acme-challenge.customer.com.challenges.saascustomdomains.com. Leave it in place, because it's needed every time the certificate renews.

Common mistakes

  • The full domain in the host field. Most DNS providers, including GoDaddy and Namecheap, add the domain for you, so app.customer.com turns into app.customer.com.customer.com. Enter just app, or @ for the root domain.

  • Old records left behind. Remove any other A, AAAA or CNAME records for the same name. A leftover AAAA (IPv6) record is a common reason a certificate never gets issued, because some requests still go to the old server. We don't use IPv6 addresses.

  • A typo in one A record. The domain may even load, but it won't verify until both IP addresses are exactly right.

  • Cloudflare's proxy is on. With the default HTTP-01 challenge, the records must be set to DNS only (grey cloud). If your user wants to keep Cloudflare's proxy on, the domain needs the DNS-01 challenge. See Challenge Types.

  • CAA records. If the domain has CAA records, one of them must allow letsencrypt.org.

  • Firewall rules on the domain. If the domain is behind Cloudflare with country blocking or other WAF rules, those can block the certificate checks too, including renewals.

To see what the rest of the world sees, look the domain up on dnschecker.org. DNS changes can take from a few minutes to a few hours to spread, depending on the old record's TTL.

3. Visit the domain to get the certificate

With the HTTP-01 challenge, the certificate is issued on the first request after the DNS records are found. Open the domain in your browser, wait a few seconds and reload. With DNS-01, the certificate is issued once the _acme-challenge record is found, which usually takes a minute or two longer.

The SSL status in the dashboard can take a little while to catch up. If the domain loads over https, it's working.

The "Configuration in progress" page

Visitors see this page when our proxies aren't set up to serve the domain yet. The usual reasons:

  • The domain was just created, or its DNS just changed. Our proxies pick up changes within a minute or two.

  • The browser saved the page. Chrome especially can keep showing it for up to an hour after the domain starts working. Try a private window, another browser or your phone.

  • Someone is visiting the www version, but the domain was created without Redirect to www. Only the exact domain you created is served. See Redirect to WWW.

  • Your subscription was cancelled or paused, for example after failed payments. See Payment Method, Invoices, VAT and Cancelling.

Don't keep deleting and recreating the domain

Every failed certificate attempt counts against Let's Encrypt's limits for that domain. Deleting and recreating a domain over and over doesn't speed anything up, and it can block the domain from getting a certificate for several hours. Fix the DNS records first. If the certificate still doesn't arrive, message us and we'll look into it.

Still stuck?

Message us through chat with the domain name and a screenshot of its DNS records, and we'll take a look.

Until next time, keep building!

Need more help? Reach out via the Intercom chat widget and we'll be right with you!

Did this answer your question?